Subject: Re: [mobile-ip] possible DOS by creating a reverse a binding

From: "Bryan Wang" <[email-masked]>
Date: Thu, 27 Feb 2003 15:42:35 -0800

Hi,

Realized that a smart attacker can wait until the two RRP succeeds, before
sending any BUs. Therefore the sulotion provided in the previous Email
doesn't solve the problem. Instead, we need a requirement like:

"When processing a valid BU that requests a CN to cache a binding, if the
care of address in the BU is the same as the home address of an existing
binding, the CN MUST selently discard the BU without creating any new
binding"

Thanks,
Bryan Wang
Elmic Systems USA

----- Original Message -----
From: "Bryan Wang" <[email-masked]>
To: <[email-masked]>
Cc: "Ed Remmell" <[email-masked]>
Sent: Thursday, February 27, 2003 2:15 PM
Subject: Re: [mobile-ip] possible DOS by creating a reverse a binding

> Hi,
>
> Realized that a smart attacker can wait until the two RRP succeeds, before
> sending any BUs. The sulotion provided in the previous Email doesn't solve
> the problem. Instead, we need a requirement like:
>
> "When processing a valid BU that requests a CN to cache a binding, if the
> care of address in the BU is the same as the home address of an existing
> binding, the CN MUST selently discard the BU without creating any new
> binding"
>
> Thanks,
> Bryan Wang
> Elmic Systems USA
>
>
>
> ----- Original Message -----
> From: "Bryan Wang" <[email-masked]>
> To: <[email-masked]>
> Cc: "Ed Remmell" <[email-masked]>
> Sent: Thursday, February 27, 2003 1:51 PM
> Subject: [mobile-ip] possible DOS by creating a reverse a binding
>
>
> > Hi,
> >
> > Just found one interesting scenatrio when testing our implemenation of
> > MIPv6:
> >
> > I have a  MN with two addresses configured, A1 & A2. It sends two BUs to
> an
> > CN, one with A1 as the home address, A2 as the alt care of addrews, the
> > second the other way round. CN sucessfully creats the two bindings ;-).
> Now
> > my CN trys to send a packet to A1, it immediately runs out of memory!
> There
> > is a never ending recursion trying to find the CoA address. In our
> > implementation, we optimiz it to route looking up and sending packet
> through
> > a virtual device, which requires dynamic memory allocation.
> >
> > Talked to Ed and we realized this might be a real DOS attack issue that
we
> > should bring to the attention of the miling list.
> >
> > Apparantly the quick solution would be adding a hard requirement as
> follows
> > to prevent creating an reverse binding.
> >
> > CN MUST NOT send an COT message to an MN's care of address if it is the
> home
> > address in an exising binding.
> >
> > Thanks,
> > Bryan Wang
> > Elmic Systems USA
> >
> >
>