Subject: [saag] can an on-path attacker drop traffic?

From: Michael Richardson <[email-masked]>
Date: Wed, 02 Sep 2020 12:27:52 -0400

I think most of us agree that an "on-path" attacker can read traffic.
They can problem inject traffic, and maybe even inject it in such a way that
it beats the real traffic.

I think that most of us can agree that an off-path attacker can not read
traffic.

So for instance, and on-path attacker can see the TCP SYN seq no or a DNS
query ID, and therefore answer correctly.
And off-path attacker has to depend upon implementation flaws to guess those
values. (Which at one point were very common)

A read-only on-path attacker that can read can be implemented with a MIRROR/SPAN port.
Or as we learnt a few years ago with creative bending of fiber.

A firewall or router is a potential on-path attacker, but it can also drop packets.
What do we call this?
This was historically called a MITM, and it implied all the attributes of
on-path.  But it is unclear to me if MITM > on-path, or MITM == on-path.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 2 Sep 2020 09:44:43 -0700

QUIC ended up with a different taxonomy:
On-path
Off-path
Limited on-path (cannot delete)

-Ekr

https://datatracker.ietf.org/doc/html/draft-ietf-quic-transport-29#section-21.12.3.1

On Wed, Sep 2, 2020 at 9:28 AM Michael Richardson <[email-masked]>
wrote:

> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

---

From: Christian Huitema <[email-masked]>
Date: Wed, 2 Sep 2020 10:00:54 -0700

The "on path" and "limited on path" can both read and inject traffic, but only on path attackers can suppress traffic.

An example of limited on path attackers are state level attackers who can observe traffic at a variety of points, bring it to a monitoring  facility, and inject traffic from there to interfere with targeted communications. TCP RST injection can easily work that way.

-- Christian Huitema 

> On Sep 2, 2020, at 9:45 AM, Eric Rescorla <[email-masked]> wrote:
> 
> 
>> On Wed, Sep 2, 2020 at 9:28 AM Michael Richardson <[email-masked]> wrote:
>>

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 2 Sep 2020 12:37:02 -0500

> Limited on-path (cannot delete)
Speaking of QUIC, I was surprised to read that QUIC is a UDP protocol. QUIC
document talks about
- connection establishment,
-stream based multiplexed operation,
-flow control,
-ACK frame
- on and on
are all TCP-like features.

My guess is that the mention of UDP-based was a sales-pitch :)

Behcet

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 2 Sep 2020 12:19:11 -0700

On Wed, Sep 2, 2020 at 10:37 AM Behcet Sarikaya <[email-masked]>
wrote:

> Speaking of QUIC, I was surprised to read that QUIC is a UDP protocol.
> QUIC document talks about

QUIC is a next-generation transport protocol that runs *over* UDP. In an
earlier era, it might have been designed to run over IP as SCTP was, but
for operational reasons (firewall/NAT traversal and the ability to iterate
rapidly), it is run over UDP instead.

-Ekr

Behcet

---

From: Nico Williams <[email-masked]>
Date: Wed, 2 Sep 2020 14:33:01 -0500

> on-path.  But it is unclear to me if MITM > on-path, or MITM == on-path.

To me on-path means physically or logically (e.g., after DNS spoofing or
route take over) in the path.

MITM is about being in the middle at some higher layer than IP.  For
example, in TLS, which you can do if you can subvert a CA trusted by the
client.

You can have an on-path (physically) attacker who nonetheless cannot
successfully mount an MITM attack on TLS traffic it gets to see and even
alter.

Nico
--

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 2 Sep 2020 22:11:27 +0200

On 2020-09-02, at 21:33, Nico Williams <[email-masked]> wrote:
> MITM is about being in the middle at some higher layer than IP.

Right.  A MITM attack can start before there is "a path".

Grüße, Carsten

---

From: Dan Harkins <[email-masked]>
Date: Wed, 30 Sep 2020 21:37:31 -0700

So what is an "active attacker" then? When people talk about protocol
security it is in the presence of a powerful attacker who can schedule
protocol sessions, and also view, modify, drop, and replay packets that
constitute the protocol. I always assumed a MITM was just an "active
attacker" in this sense.

   Seems we should be very careful when saying exactly what capabilities
this "on path attacker" has if it's not the same as a MITM/"active
attacker". And if these capabilities are a subset of the traditional
"active attacker" then what is the point of making the distinction?

   regards,

   Dan.

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 1 Oct 2020 08:29:05 +0200

An active attacker actively changes the situation. Need not be on path, traditional blind session hijacking is an active attack. A Janus attack (MITM) obviously is active. 

Sent from mobile, sorry for terse

> On 1. Oct 2020, at 06:37, Dan Harkins <[email-masked]> wrote:
> 
>