Subject: [manet] Comments for draft-ietf-manet-nhdp-olsrv2-sec-01

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 17:23:40 +0200

Please consider the below threat scenario,

AB

---------- Forwarded message ----------
From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 17:20:40 +0200
Subject: AB#3 Comments for WGLC draft-ietf-manet-nhdp-sec-threats-02
To: manet <[email-masked]>
Cc: draft-ietf-manet-nhdp-sec-threats
<[email-masked]>

This message Author: Abdussalam Baryun
Classified: I-D Review

Second Message Reply to your WGLC request dated 25/03/2013
The I-D Reviewed By: Abdussalam Baryun (AB)         Dated: 09/04/2013
Reviewer Comment AB#3: Example Scenario Threat
++++++++++++++++++++++++++++++++++++

Copyright Notice:
Copyright (c) 2012 IETF Trust and the person identified as the
message author. All rights reserved.
This message is to comment on the MANET WG work in progress I-D:
draft-ietf-manet-nhdp-sec-threats-02 [I-D], which means this message
may contain parts/texts of the I-D under review
=======================================

As a respond to my first to AB#1, AB#2 messages, and to [1] message.
The NHDP threat related to physical attacks were ignored by the I-D.
The I-D describes non-physical attacks in section 4 but does not for
physical attacks, which has threats. The neighbors may get both
together non-physical and physical, as if two or more neighbors are in
radio range coverage. I don't think this was introduced in the I-D,
which I hope editors follow.

Military Scenario Example:

Identity or link spoof can occur in other scenarios mentioned in I-D
(i.e. spoofed the address while attacker is out of that neighbor radio
coverage, as in section 4.4.1 Fig.1 ). Malicious router (M) may not
identity-spoof attack only after the neighbor is physically attacked,
then M takes over that neighbor identity and responsibilities, even if
they were in same radio coverage. This is a threat because these
neighbors are in range of each other, and the node disapers from the
network. The I-D does not consider the situation where the neighbor
disapears from the network but replaced by an attacker M. This example
scenario assumes that neighbors are in range but not aware of the
physical attack, and the malicious node is aware.

AB> Please editors of the I-D, consider in section 4.4.1 to add the
threat described, if not clear for you, please reply,

Best Regards
Abdussalam Baryun

This message is owned by the author, and was not sent to any private
email box, just IETF emails.
********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

References:
[1] The message below, by Dearlove, C., (2013), IETF MANET WG
Discussion list, Re: [manet] AB#1 Comments for WGLC
draft-ietf-manet-nhdp-sec-threats-02, 09.04.2013.

On 4/9/13, Dearlove, Christopher (UK) <[email-masked]> wrote:
> I'm neither recommending that a reference is included or excluded, I'm just
> providing here where one good source of definitions. Whether to reference it
> is a judgement call as to what is considered widely known, and what isn't.
>
> But that definition is not limited to physical attack.
>
> --
> Christopher Dearlove
> Senior Principal Engineer, Communications Group
> Communications, Networks and Image Analysis Capability
> BAE Systems Advanced Technology Centre
> West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
> Tel: +44 1245 242194 |  Fax: +44 1245 242124
> [email-masked] | http://www.baesystems.com
>
> BAE Systems (Operations) Limited
> Registered Office: Warwick House, PO Box 87, Farnborough Aerospace Centre,
> Farnborough, Hants, GU14 6YU, UK
> Registered in England & Wales No: 1996687
>
>
> -----Original Message-----
> From: Abdussalam Baryun [mailto:[email-masked]]
> Sent: 09 April 2013 12:44
> To: Dearlove, Christopher (UK)
> Cc: manet
> Subject: Re: [manet] AB#1 Comments for WGLC
> draft-ietf-manet-nhdp-sec-threats-02
>
> ----------------------! WARNING ! ----------------------
> This message originates from outside our organisation,
> either from an external partner or from the internet.
> Keep this in mind if you answer this message.
> Follow the 'Report Suspicious Emails' link on IT matters
> for instructions on reporting suspicious email messages.
> --------------------------------------------------------
>
> Hi Chris,
>
> The I-D seems not to define physical attacks (my understanding), which
> I was not sure of but [1] (mentioned in first AB#1 message) did
> include, but I think your input is prefered to include in the I-D or
> used,
>
> AB
>
> On 4/9/13, Dearlove, Christopher (UK) <[email-masked]>
> wrote:
>> AB> you don't define *Threat*, and *Attack*
>>
>> Personally, I would start with ISO 27000 which has:
>>
>> =====
>> 2.45
>> threat
>> potential cause of an unwanted incident, which may result in harm to a
>> system or organization
>>
>> 2.4
>> attack
>> attempt to destroy, expose, alter, disable, steal or gain unauthorized
>> access to or make unauthorized use of
>> an asset (2.3)
>>
>> 2.3
>> asset
>> anything that has value to the organization
>> NOTE There are many types of assets, including:
>> a) information (2.18);
>> b) software, such as a computer program;
>> c) physical, such as computer;
>> d) services;
>> e) people, and their qualifications, skills, and experience; and
>> f) intangibles, such as reputation and image.
>>
>> 2.18
>> information asset
>> knowledge or data that has value to the organization
>> =====
>>
>> (The rules are that you may substitute in the definition, so attack may
>> be
>> parsed as "attempt to destroy, expose, alter, disable, steal or gain
>> unauthorized access to or make unauthorized use of anything that has
>> value
>> to the organization".)
>>
>> [There is also an overlapping set of definitions in ISO 27032, but 27000
>> is
>> more relevant here.]
>>
>> I don't know if there are any RFCs that reference ISO 27000.
>>
>> --
>> Christopher Dearlove
>> Senior Principal Engineer, Communications Group
>> Communications, Networks and Image Analysis Capability
>> BAE Systems Advanced Technology Centre
>> West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
>> Tel: +44 1245 242194 |  Fax: +44 1245 242124
>> [email-masked] | http://www.baesystems.com
>>
>> BAE Systems (Operations) Limited
>> Registered Office: Warwick House, PO Box 87, Farnborough Aerospace
>> Centre,
>> Farnborough, Hants, GU14 6YU, UK
>> Registered in England & Wales No: 1996687
>>
>>
>> ********************************************************************
>> This email and any attachments are confidential to the intended
>> recipient and may also be privileged. If you are not the intended
>> recipient please delete it from your system and notify the sender.
>> You should not copy it or use it for any purpose nor disclose or
>> distribute its contents to any other person.
>> ********************************************************************
>>
>>
>
>

---

From: "Stan Ratliff (sratliff)" <[email-masked]>
Date: Tue, 9 Apr 2013 17:43:50 +0000

AB, 

On Apr 9, 2013, at 11:23 AM, Abdussalam Baryun wrote:

[snip]
[snip]
> email box, just IETF emails.

[snip]

I'm somewhat concerned by these 3 blocks of text in your emails. The IETF have quite a few rules & regs about intellectual property rights; some of the above text, if taken in the most stringent manner, could be seen to preclude use of any of your ideas into the associated documents. Please explain the motivation behind the text I've highlighted above. 

Regards,
Stan