Subject: Re: [ippm] Kathleen Moriarty's Discuss on draft-ietf-ippm-2680-bis-04: (with DISCUSS)

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Wed, 19 Aug 2015 15:01:59 -0400

Hi Kathleen,

In resolving Alissa's Comment, we will add a full paragraph from RFC 7312,
including the reference to the LMAP Framework. I believe we covered
network operator's sensitive information in sections 7 and 8 of the 
Framework.

RFC 2679 and RFC 2680 both depend on the original IPPM framework,
RFC 2330, which is limited to active measurement.

hope this helps,
Al 
________________________________________
From: Kathleen Moriarty [[email-masked]]
Sent: Wednesday, August 19, 2015 2:34 PM
To: The IESG
Cc: Bill Cerveny; [email-masked]; [email-masked]; [email-masked]
Subject: Kathleen Moriarty's Discuss on draft-ietf-ippm-2680-bis-04: (with DISCUSS)

Kathleen Moriarty has entered the following ballot position for
draft-ietf-ippm-2680-bis-04: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ippm-2680-bis/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

For the most part, this draft looks good, but the security considerations
haven't been updated from the previous release.  An important
consideration for traffic measurement is that it could be used for
reconnaissance activity.  By colecting results (passively or actively) of
measurement data, you learn more about the network and that can be used
in subsequent attacks.  Can you add this consideration into the text?

Thank you!

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Wed, 19 Aug 2015 22:32:28 -0400

________________________________________
From: Kathleen Moriarty [[email-masked]]
Sent: Wednesday, August 19, 2015 6:48 PM
To: MORTON, ALFRED C (AL)
Cc: The IESG; Bill Cerveny; [email-masked]; [email-masked]; [email-masked]
Subject: Re: Kathleen Moriarty's Discuss on draft-ietf-ippm-2680-bis-04: (with DISCUSS)

>Al,
>
>In case it helps, when I refer to reconnaissance activity, attackers
>use metrics or results from metrics to map networks, learn open ports/
>paths to host and other information that makes attacking the host,
>network or path to the host easier.  This may help differentiate it
>from Alissa's privacy concern.  Network reconnaissance is a security
>operational problem that's been around for a while.
>
>Thanks,
>Kathleen

Thanks for sharing these examples.
I've been thinking about what reconnaissance measurements
would entail, and how reconnaissance is *similar*
to the methods and the streams we use to measure metrics.
(I started out to differentiate the two - it didn't go that way.)

For all of IPPM's measurements, testing entities are required to 
provide the Source and Destination IP addresses, and some 
information about the path between Src and Dst. Path assessments
often involve running traceroute, and that would be reconnaissance since
we will discover some approximation of the path.

When we configure a test stream in IPPM, we specify more than the 
Source and Dest addresses, we usually specify the transport protocol and the 
ports as well.  Repeated tests with one or both ports determined at
random from a range is somewhat similar to port scanning. 
Perhaps it's only the rate of port changes that differentiates
measurement from scanning/recon.

The IPPM methods require that processes at both Src and Dst hosts
are under the tester's control ( or permission has been obtained to use
the hosts, at least). This seems to be a key difference from reconnaissance,
at first.  An attacker using IPPM methods can only learn about 
networks (paths, open ports, delay, loss) between the hosts they control.
But, an attacker could have a large scale botnet at their disposal, 
and legitimate testing is also conducted on large scale.

So, it's beginning to look (to me) as though the main difference 
between network characterization and network reconnaissance
is the intent of the entity operating the tests: Good or Evil.

Since I have trouble distinguishing characterization from recon,
I'm not clear how to qualify recon and what to write to address your concern.

We need a good idea here,
Al

PS: I note that the Gen-ART review has caused us to write a new
draft to address comments more fully and appropriately. Perhaps
examination of recon providing obejctive differentiation from legit. net. 
characterization, and what recommendations are possible (beyond 
"don't engage in recon for evil purposes") could be studied more
fully in the timeframe of this new draft.   ???

On Wed, Aug 19, 2015 at 3:12 PM, Kathleen Moriarty
<[email-masked]> wrote:
> Hi Al,
>
> My concern isn't privacy related.  I took a look at the security
> considerations from RFC7312 and this doesn't cover using the metrics
> for reconnaissance activity for later use in attacks.  Is that covered
> and referenced somewhere else?
>
> Thanks,
> Kathleen
>
> On Wed, Aug 19, 2015 at 3:01 PM, MORTON, ALFRED C (AL) <[email-masked]> wrote:
>> Hi Kathleen,
>>
> --
> Best regards,
> Kathleen

--

Best regards,
Kathleen

---

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 19 Aug 2015 11:34:10 -0700

Thank you!

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 19 Aug 2015 15:12:47 -0400

Hi Al,

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 19 Aug 2015 18:48:11 -0400

Al,

In case it help, when I refer to reconnaissance activity, attackers

Thanks,
Kathleen

-- 

Best regards,
Kathleen

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Thu, 20 Aug 2015 07:46:11 -0400

> -----Original Message-----
> From: MORTON, ALFRED C (AL)
...
> Since I have trouble distinguishing characterization from recon, I'm not
> clear how to qualify recon and what to write to address your concern.
> 
> PS: I note that the Gen-ART review has caused us to write a new draft to
> address comments more fully and appropriately. Perhaps examination of
> recon providing obejctive differentiation from legit. net.
> characterization, and what recommendations are possible (beyond "don't
> engage in recon for evil purposes") could be studied more
And this is the URL for the draft (didn't have it while flying):
https://tools.ietf.org/html/draft-morton-ippm-2330-stdform-typep-00

I should have mentioned that this draft intends to update the IPPM 
framework RFC, so it would be applicable to all active tests.

Al

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 20 Aug 2015 08:02:39 -0400

Good morning, Al.

Thanks very much for looking into my question as deeply as you did.
If you could write another draft on this, I think it would be very
helpful as others would better understand the problem and how metrics
may be used maliciously.  For this draft, could you add a sentence or
two into the security considerations to alert to the issue and then
the deeper explanation can come later?

Thank you,
Kathleen

-- 

Best regards,
Kathleen