Subject: [nemo] comments on draft-jung-nemo-threat-analysis

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 23 Jul 2004 14:04:18 -0700

hi,

a couple of comments on draft-jung-nemo-threat-analysis

section 3.2.1 describes an attack where a MNN uses another MNN's
source address to tunnel packets through the MR-HA tunnel. is
this specific to NEMO? how is it different from a node A using
another node's (say node B) source address, both being on the same
link?	

section 4.1

> If one of the tunnel paths is broken for any reason, the MR(MR1) associated 
> with the faulty path loses Internet connection, and should find an
> alternative bi-directional tunnel path through another MR2. In this case, 
> MR1 becomes a nested MR of MR2. NEMO basic draft[3] describes that MR SHOULD 
> not respond to the unsolicited RA messages to its egress interface, 
> but according to the MR operations by multihoming draft B.2.2 [6], the MR1 SHOULD 
> listen the RA from alternative MR2 on its ingress interface. 
> At this point, a malicious MR may advertise a RA with a fake CoA to MR1. 
> Then the MR1 will get a wrong CoA information.

couldnt understand the statement "MR SHOULD not respond to the
unsolicted RA message to its egress interface". infact NEMO
basic support says (section 5.6)

    However, a Mobile Router MUST NOT ignore Router
    Advertisements received on the egress interface.

Vijay

---

From: "Souhwan Jung" <[email-masked]>
Date: Sat, 24 Jul 2004 22:00:09 +0900

Hi Vijay,

Thanks for your comments.
Please see my answer in between the lines.

> another node's (say node B) source address, both being on the same

In MIP6, there are no intermediate nodes like MR and HA(of MR), therefore, the victim may easily locate the attacker if the attacker is located in the same local link with the spoofed node. But, in the attack I described, the victim has no way to locate the attacker, because the spoofed address could be the address of any node in the Internet. I think this makes a big difference from MIP6 case.

>     Advertisements received on the egress interface.

Sorry for not exactly citing the statements. The statements I try to mention from the basic draft is (section 5.6)

"A Mobile Router SHOULD NOT send unsolicited Router Advertisements
   and SHOULD NOT reply to Router Solicitations on any egress interface
   when that interface is attached to a visited link."

Anyway, the faulty MR should find the neighbor MR, the attack is still valid, right? 

Souhwan

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 26 Jul 2004 16:45:41 -0700

Souhwan Jung wrote:
> In MIP6, there are no intermediate nodes like MR and HA(of MR), 
> therefore, the victim may easily locate the attacker if the 
> attacker is located in the same local link with the spoofed node. 

this is only if we assume ingress filtering is turned on
on the IPv6 link.

> But, in the attack I described, the victim has no way to locate 
> the attacker, because the spoofed address could be the address 
> of any node in the Internet. I think this makes a big difference 
> from MIP6 case.

okay, I now understand the attack. this has been fixed in the
latest basic support draft.

http://people.nokia.net/vijayd/nemo/issue23.txt

> Anyway, the faulty MR should find the neighbor MR, the attack is still valid, right? 

once MR1 becomes a nested MR of MR2, MR1's egress interface is
connected to MR2's ingress interface.

- MR2 responds to router solicitations on the ingress interface
- MR2 ignores router solicitations on the egress interface
- MR1 processes router advertisements received on its egress interface
- MR1 ignores router solicitations on the egress interface

so what is the problem?

Vijay

---

From: "Souhwan Jung" <[email-masked]>
Date: Fri, 30 Jul 2004 09:14:25 +0900

> - MR1 ignores router solicitations on the egress interface

As you stated above, there is no problem, once MR1 finds MR2 and netsed to it.
The attack I described is the situation before MR1 is nested to MR2. 
In the process of finding MR2, MR1 might be deceived by a malicious MR.
I pointed out the attack for claiming that a kind of message authetication is necessry among multiple MRs.

Souhwan

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 29 Jul 2004 17:39:28 -0700

> I pointed out the attack for claiming that a kind of message authetication is necessry among multiple MRs.

okay. but this doesnt still explain the following sentence in your
draft.

    NEMO basic draft[3] describes that MR SHOULD not respond to the
    unsolicited RA messages to its egress interface, but according to the
    MR operations by multihoming draft B.2.2 [6], the MR1 SHOULD listen
    the RA from alternative MR2 on its ingress interface.

NEMO basic support has no such restriction.

Vijay