Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Ray Hunter <[e-mail]>]

> Lorenzo Colitti <mailto:[e-mail]>
> 20 November 2013 09:14
>
> Er... which is what this draft says?
>
> These are an example set of generic rules to be applied. Each would
> normally be configurable, either by the user directly or on behalf of
> the user by a subscription service.
>
So what does the draft really say?

Here's some filtering rules, that you may or may not like, which may or
may not be overridden, which may change over time, which only mitigate a
very limited number of threats, and maybe the ISP will manage the
security policy but maybe the end user wants to take this responsibility
......

Where's the evidence to say that this approach is any better than an
open security policy of "allow everything bi-directionally" ?

The threats are listed in the draft as:

   o  denial of service by packet flooding: overwhelming either the
      access bandwidth or the bandwidth of a slower link in the
      residential network (like a slow home automation network) or the
      CPU power of a slow IPv6 host (like networked thermostat or any
      other sensor type nodes);

not covered.

   o  denial of service by Neighbor Discovery cache exhaustion
      [RFC6583]: the outside attacker floods the inside prefix(es) with
      packets with a random destination address forcing the CPE to
      exhaust its memory and its CPU in useless Neighbor Solicitations;

not covered.

   o  denial of service by service requests: like sending print jobs
      from the Internet to an ink jet printer until the ink cartridge is
      empty or like filing some file server with junk data;

not covered.e.g. port 515

   o  unauthorized use of services: like accessing a webcam or a file
      server which are open to anonymous access within the residential
      network but should not be accessed from outside of the home
      network or accessing to remote desktop or SSH with weak password
      protection;

not covered. e.g. port 8080.

   o  exploiting a vulnerability in the host in order to get access to
      data or to execute some arbitrary code in the attacked host such
      as several against old versions of Windows;

not covered.

   o  trojanized host (belonging to a Botnet) can communicate via a
      covert channel to its master and launch attacks to Internet
      targets.

not covered.

And in the Security section, the draft only addresses "Unauthorized
access because vulnerable ports are blocked" ?

IMHO this threat is anyway blocked by machine firewalls running on every
modern OS shipping today (any device that is likely to support IPv6)

-- 
Regards,
RayH