Subject: RE: [tcpm] new work item: TCP security issue

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 20 Apr 2004 23:04:17 -0400

One specific protocol for which this is a concern is discussed here:

http://www.us-cert.gov/cas/techalerts/TA04-111A.html

I will note that exploits for this vulnerability are already known to be
circulating in "black hat" circles.

You may also have noticed that the press has demonstrated some interested in
this today; there is much more speculation about the potential applicability
of this vulnerability to be found there.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Tim Shepard [mailto:[email-masked]]
> Sent: Tuesday, April 20, 2004 7:56 PM
> To: Peterson, Jon
> Cc: Joe Touch; [email-masked]
> Subject: Re: [tcpm] new work item: TCP security issue 
> 
> 
> 
> > Your concern about the abuse of process is understandable, 
> and I hope it is
> > obvious that it was only the urgency of progressing this 
> work which prompted
> > us to take an action which, as you rightfully assert, we 
> have no legitimate
> > process grounds for taking.
> 
> 
> I must be missing something.   Could someone please explain why this
> is urgent?   (I've read the draft once, and I'm reading it again now,
> and I don't see why this would be considered urgent.)
> 
> Has the stuff needed for me to understand why this is urgent been
> deliberately omitted from the draft (to avoid revealing something to
> the black hats)?
> 
> 
> 			-Tim Shepard
> 			 [email-masked]
> 

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Joe Touch <[email-masked]>
Date: Tue, 20 Apr 2004 21:31:33 -0700

> http://www.us-cert.gov/cas/techalerts/TA04-111A.html

And here:

RFC 2385.

Urgently. Nearly 6 years ago ;-)

Joe

---

From: Nader Salehi <[email-masked]>
Date: Thu, 22 Apr 2004 11:44:33 -0700

I am not saying there is no problem here, but there are already
mechanisms in place to reduce the risk in BGP.  BTSH can effectively
eliminate the danger spoofing problem for eBGP.  Many vendors either
have already implemented BTSH or are in the process of it.  Also, if
MD5 checksum is enabled, then hackers cannot easily reset a TCP
connection even the know the sequence number.  I think the document
should address (and incorporate) these mechanisms.

My $0.02

Nader