Subject: [nemo] (Threat) Security Problems/Issues

From: Seongho Cho <[email-masked]>
Date: Mon, 8 Mar 2004 18:38:47 +0900

Hi folks,

 I think Prof. Wu will send an e-mail on the previous face2face meeting.
 For the first step, we will discuss on security issues on NEMO basic support.

 As a start, I will briefly describe listed issues of Security Consideration of
 NEMO Basic Support draft and some threats from threat analysis drafts.
 Followings are my own view/opinion, not discussed in the last meeting.
 Any kinds of comments are welcomed.

 First, from the Security Consideration Section 

  1.1 Signaling messages between the MR and the HA
    - all signaling messages MUST be authenticated by IPsec

    * problem/issue:
      1. The HA Discovery Request message using anycast address can (or may) not
         use IPsec. Therefore, it can be vulnerable to R-bit spoofing attack.
      2. any other signaling messages should be considered?

  1.2. MR operations
    - Ingress filtering
      scope:
       1. the IP spoofed bi-directional tunnel from nodes in the Mobile Network 
        ->  the MR SHOULD check the IP source address whether it belongs to the own MNP
       2. IP-in-IP tunneled packet from nodes in the Mobile Network
        -> the MR has to forward the decapsulated packet and SHOULD check the   
           source address of the inner packet.

    * problem/issue: MR operations are considered enough?

  1.3 HA operations
    - Verifying bi-directional tunnel packets
      scope:
       1. the source address of tunnel packets MUST be the MR's CoA
       2. the source address of the inner header MUST be a correct address

    - Routing updates injected from the MR into the Home Link
      scope:
       1. routing updates MUST be verified before processing.

    * problem/issue: HA operations are considered enough?

  1.4 Mobile Host operations
    - refer to the Mobile IPv6 specification for security considerations

 Second, from some threat analysis drafts

  2.1 BU spoofing 
    - an attacker MNN in the Mobile Network can send spoofed BU.
      -> IMO, ingress filtering and IPsec AH can solve, considering 1.1 and 1.2.

  2.2 DoS attack due to error processing 
    - a malicious MR sends a BU on the explicit mode to its HA claiming
      a MNP belonging to another MR
      -> IMO, this BU would not be authenticated.
  
  2.3 Location privacy
    - the desire of a Mobile Host (or Router) not to reveal its current CoA. 

    * problem/issue: Is it MIP specific or NEMO specific?

  2.4 R bit spoofing of HA discovery Request
    - mentioned above at 1.1.
 
 Bests,
 Seongho
-- 
------------------------------------------------------------------------
 Cho, Seongho (Ph.D. candidate)

 Information Networking & Computing Laboratory,
 School of Computer Science and Engineering, Seoul National University
 San 56-1, Shillim dong, Gwanak gu, Seoul, Korea, 151-744.

 TEL: +82-2-884-3936 
 FAX: +82-2-871-4912 
 http://popeye.snu.ac.kr/~shcho ; mailto:[email-masked] 
------------------------------------------------------------------------