Subject: comments on nordmark-multi-threats

From: Pekka Savola <[email-masked]>
Date: Sun, 9 Nov 2003 06:25:27 +0200 (EET)

Hi,

I made a very quick pass through the document on the plane.  The document 
is excellent, at least the parts that are there.  I didn't go through the 
analysis to see if there might be some remainder threats.  

One thing the doc could maybe be slightly clearer on is which "security
problems" the different attacks rely on (e.g., off-link TCP ACK spoofing,
TCP seq number synchronization (could be very challenging if tryly random
seq/ack numbers are used, etc.)

A couple of observations and minor nits below, nothing major.

   Similarly, if DNS can be compromised, and a change can be made to an
   advertised resource record to advertise a different IP address for a
   hostname, effectively taking over that hostname.

==> does this imply DNS threats, in addition to just hacking thezone?

   Any system that is along the path from the source to the destination
   host can be compromised and used to redirect traffic.  Systems may be
   added to the best path to accomplish this.  Further, even systems
   that are on multi-access links that do not provide security can also
   be used to redirect traffic off of the normal path.  For example, ARP
   and ND spoofing can be used to attract all traffic for the legitimate
   next hop across an Ethernet.

==> these apply to DNS the paths and links to the DNS server as well, of 
course.

   An attribute of this type of attack is that A will simply think that
   B is faulty since its flow and congestion control mechanisms don't
   seem to be working.  Detecting that the stream of ACK packets is
   generated from X and not from A might be challenging, since the rate
   of ACK packets might be relatively low.  This type of attack might  
   not be common today because it requires that X remain on the path in
   order to sustain the DoS attack, but the addition of multihoming
   redirection mechanisms might potentially remove that constraint.

==> it is not readily apparent why X would need to remain on the path to 
continue this, but I didn't think this through.  Maybe need spelling out?

fully editorial
---------------

   traced to the attacker.  An example of this is to use protocols which
   cause reflection with or without amplification [PAXSON01].
   Reflection without amplification can be accomplished by an attacker  

==> insert a new line after PAXSON ?

  this type of attack could either case redirection (so that the
 
==> s/case/cause/

   network before any reassignment.  Note that this does not require  
   explicit mechanism.  This can instead be implemented by locator reuse

==> s/require/require an/

   multihoming solution would fail our "no worse than what we have now"
   litmus test.  However, given that ingress filtering deployment is far

==> "litmus test" ?

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 13 Nov 2003 15:25:50 +0100 (CET)

Pekka,

Thanks for your comments.

> seq/ack numbers are used, etc.)

We can try to add this.

> ==> does this imply DNS threats, in addition to just hacking thezone?

I don't know what "hacking the zone" means.
A DNS lookup, without DNSsec, can be spoofed if the
attacker can spoof the source address, match a (16 bit, probably predictable)
number in the query, and guess the domain name that was in the query.
 
> ==> these apply to DNS the paths and links to the DNS server as well, of 

Yes, until DNSsec gets deployed.

> continue this, but I didn't think this through.  Maybe need spelling out?

Should spell that out. Its ability to move off the path is constrained
by whatever amount of ingress filtering is used.

> fully editorial

Thanks - taken care of.

>    litmus test.  However, given that ingress filtering deployment is far

Originally paper used to test the pH of a solution.
Used a lot more generally; google it for examples of broad usage.

  Erik

---

From: Pekka Savola <[email-masked]>
Date: Thu, 13 Nov 2003 17:18:54 +0200 (EET)

Hi,

Thanks for the response.  Just one comment below.

> number in the query, and guess the domain name that was in the query.

"If DNS is compromised" was not unambiguous whether you referred to all 
the threats to the DNS system, rather than just somehow modifying what's 
advertised in the DNS to begin with (e.g., by compromising the DDNS 
updates).  The question seems obvious, but it may be useful to list a few 
examples of DNS threats to spell this out.

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 13 Nov 2003 16:57:25 +0100 (CET)

> examples of DNS threats to spell this out.

I'll add a reference to draft-ietf-dnsext-dns-threats-04.txt
which contains the threats.

  Erik