Subject: [mobile-ip] Issue 239 Resolution

From: [email-masked]
Date: Wed, 12 Feb 2003 06:07:17 -0600

Pekka,

Issue 239 which is about security implications for DHAAD has been
discussed previously on the ML.

Please take a look at issue 123. I believe this is revisiting the same
issue and hence should be closed.

-Basavaraj

---

From: Pekka Savola <[email-masked]>
Date: Wed, 19 Feb 2003 18:34:46 +0200 (EET)

Hi,

> issue and hence should be closed.

Thanks for the pointer.

I'm not sure if the text is sufficient.  I'm particularly worried about 
the new ICMP DHAAD message.  You cannot scan whole /64's of networks, and 
any tools which give you addresses of nodes on a link are useful, 
especially if there are more than one addresses, or the nodes are built 
for a specific purpose.

This is a bit similar, but weaker, than "directed broadcast" type attacks
or network mapping: sending a probe to 1.1.1.255 to find out all nodes in
the subnet, possibly even with a spoofed source address to redirect
replies.  What makes this less (AFAICS) is that it is an anycast address
-- and AFAIR only one of the anycast nodes will respond -- but I might be
wrong.

My fear is that these kind of ICMP features might lead to blocking ICMPv6
in firewalls...

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: gabriel montenegro <[email-masked]>
Date: Fri, 21 Feb 2003 09:44:25 +0100

So what is your suggestion?

Are you asking for more text changes or additions to the
DHAAD section in security considerations?:

  http://www.piuha.net/~jarkko/publications/mipv6/drafts/mobilev6.html#cons:dynha-disc

Could you suggest those changes, perhaps along the lines of your message
below?

-gabriel

---

From: Pekka Savola <[email-masked]>
Date: Sat, 22 Feb 2003 11:19:26 +0200 (EET)

Hi,

> Could you suggest those changes, perhaps along the lines of your message

Perhaps add something, along the lines of:

15.5 Dynamic Home Agent Address Discovery

The dynamic home agent address discovery function could be used to learn 
the addresses of home agents in the home network. Attackers will not be 
able to learn much from this information, however, and mobile nodes cannot 
be tricked into using wrong home agents as all other communication with 
the home agents is secure. 

==>

15.5 Dynamic Home Agent Address Discovery

The dynamic home agent address discovery function could be used to learn 
the addresses of home agents in the home network.

Being able to learn addresses of nodes may be of some use because
brute-force scanning of the address space is not practical with IPv6, and
any means which make mapping the networks easier may be useful.  For
example, if a security threat targeted at routers or even home agents is
discovered, having a simple ICMP mechanism to find out possible targets
easily may prove to be a minor security risk.

Apart from discovering the address(es) of home agents, attackers will not
be able to learn much from this information, however, and mobile nodes
cannot be tricked into using wrong home agents as all other communication
with the home agents is secure.

---

From: Jari Arkko <[email-masked]>
Date: Sat, 22 Feb 2003 11:28:45 +0200

> easily may prove to be a minor security risk.

Ok.

The last sentence sounds a bit strange though. Maybe it could be changed a bit,
such as "... targets easily may prove to be an additional (though minor)
security risk".

> with the home agents is secure.

Ok

Jari

---

From: gabriel montenegro <[email-masked]>
Date: Sat, 22 Feb 2003 10:53:39 +0100

> such as "... targets easily may prove to be an additional (though minor)

I'd also suggest a slight change on the paragraph above. I'd like to
mention that this could be useful to attackers in order to clarify this
before the very end of the paragraph.

With my suggestion and Jari's this  is how I see the 2nd paragraph:

"The ability to learn addresses of nodes may be useful to attackers, because
brute-force scanning of the address space is not practical with IPv6. Thus,
they could benefit from any means which make mapping the networks easier.  For
example, if a security threat targeted at routers or even home agents is
discovered, having a simple ICMP mechanism to find out possible targets
easily may prove to be an additional (though minor) security risk."

Ok otherwise.

-gabriel