Subject: [manet] AB#3 Comments for WGLC draft-ietf-manet-nhdp-sec-threats-02

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 17:20:40 +0200

This message Author: Abdussalam Baryun
Classified: I-D Review

Second Message Reply to your WGLC request dated 25/03/2013
The I-D Reviewed By: Abdussalam Baryun (AB)         Dated: 09/04/2013
Reviewer Comment AB#3: Example Scenario Threat
++++++++++++++++++++++++++++++++++++

Copyright Notice:
Copyright (c) 2012 IETF Trust and the person identified as the
message author. All rights reserved.
This message is to comment on the MANET WG work in progress I-D:
draft-ietf-manet-nhdp-sec-threats-02 [I-D], which means this message
may contain parts/texts of the I-D under review
=======================================

As a respond to my first to AB#1, AB#2 messages, and to [1] message.
The NHDP threat related to physical attacks were ignored by the I-D.
The I-D describes non-physical attacks in section 4 but does not for
physical attacks, which has threats. The neighbors may get both
together non-physical and physical, as if two or more neighbors are in
radio range coverage. I don't think this was introduced in the I-D,
which I hope editors follow.

Military Scenario Example:

Identity or link spoof can occur in other scenarios mentioned in I-D
(i.e. spoofed the address while attacker is out of that neighbor radio
coverage, as in section 4.4.1 Fig.1 ). Malicious router (M) may not
identity-spoof attack only after the neighbor is physically attacked,
then M takes over that neighbor identity and responsibilities, even if
they were in same radio coverage. This is a threat because these
neighbors are in range of each other, and the node disapers from the
network. The I-D does not consider the situation where the neighbor
disapears from the network but replaced by an attacker M. This example
scenario assumes that neighbors are in range but not aware of the
physical attack, and the malicious node is aware.

AB> Please editors of the I-D, consider in section 4.4.1 to add the
threat described, if not clear for you, please reply,

Best Regards
Abdussalam Baryun

This message is owned by the author, and was not sent to any private
email box, just IETF emails.
********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

References:
[1] The message below, by Dearlove, C., (2013), IETF MANET WG
Discussion list, Re: [manet] AB#1 Comments for WGLC
draft-ietf-manet-nhdp-sec-threats-02, 09.04.2013.

On 4/9/13, Dearlove, Christopher (UK) <[email-masked]> wrote:
> I'm neither recommending that a reference is included or excluded, I'm just
> providing here where one good source of definitions. Whether to reference it
> is a judgement call as to what is considered widely known, and what isn't.
>
> But that definition is not limited to physical attack.
>
> --
> Christopher Dearlove
> Senior Principal Engineer, Communications Group
> Communications, Networks and Image Analysis Capability
> BAE Systems Advanced Technology Centre
> West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
> Tel: +44 1245 242194 |  Fax: +44 1245 242124
> [email-masked] | http://www.baesystems.com
>
> BAE Systems (Operations) Limited
> Registered Office: Warwick House, PO Box 87, Farnborough Aerospace Centre,
> Farnborough, Hants, GU14 6YU, UK
> Registered in England & Wales No: 1996687
>
>
> -----Original Message-----
> From: Abdussalam Baryun [mailto:[email-masked]]
> Sent: 09 April 2013 12:44
> To: Dearlove, Christopher (UK)
> Cc: manet
> Subject: Re: [manet] AB#1 Comments for WGLC
> draft-ietf-manet-nhdp-sec-threats-02
>
> ----------------------! WARNING ! ----------------------
> This message originates from outside our organisation,
> either from an external partner or from the internet.
> Keep this in mind if you answer this message.
> Follow the 'Report Suspicious Emails' link on IT matters
> for instructions on reporting suspicious email messages.
> --------------------------------------------------------
>
> Hi Chris,
>
> The I-D seems not to define physical attacks (my understanding), which
> I was not sure of but [1] (mentioned in first AB#1 message) did
> include, but I think your input is prefered to include in the I-D or
> used,
>
> AB
>
> On 4/9/13, Dearlove, Christopher (UK) <[email-masked]>
> wrote:
>> AB> you don't define *Threat*, and *Attack*
>>
>> Personally, I would start with ISO 27000 which has:
>>
>> =====
>> 2.45
>> threat
>> potential cause of an unwanted incident, which may result in harm to a
>> system or organization
>>
>> 2.4
>> attack
>> attempt to destroy, expose, alter, disable, steal or gain unauthorized
>> access to or make unauthorized use of
>> an asset (2.3)
>>
>> 2.3
>> asset
>> anything that has value to the organization
>> NOTE There are many types of assets, including:
>> a) information (2.18);
>> b) software, such as a computer program;
>> c) physical, such as computer;
>> d) services;
>> e) people, and their qualifications, skills, and experience; and
>> f) intangibles, such as reputation and image.
>>
>> 2.18
>> information asset
>> knowledge or data that has value to the organization
>> =====
>>
>> (The rules are that you may substitute in the definition, so attack may
>> be
>> parsed as "attempt to destroy, expose, alter, disable, steal or gain
>> unauthorized access to or make unauthorized use of anything that has
>> value
>> to the organization".)
>>
>> [There is also an overlapping set of definitions in ISO 27032, but 27000
>> is
>> more relevant here.]
>>
>> I don't know if there are any RFCs that reference ISO 27000.
>>
>> --
>> Christopher Dearlove
>> Senior Principal Engineer, Communications Group
>> Communications, Networks and Image Analysis Capability
>> BAE Systems Advanced Technology Centre
>> West Hanningfield Road, Great Baddow, Chelmsford, CM2 8HN, UK
>> Tel: +44 1245 242194 |  Fax: +44 1245 242124
>> [email-masked] | http://www.baesystems.com
>>
>> BAE Systems (Operations) Limited
>> Registered Office: Warwick House, PO Box 87, Farnborough Aerospace
>> Centre,
>> Farnborough, Hants, GU14 6YU, UK
>> Registered in England & Wales No: 1996687
>>
>>
>> ********************************************************************
>> This email and any attachments are confidential to the intended
>> recipient and may also be privileged. If you are not the intended
>> recipient please delete it from your system and notify the sender.
>> You should not copy it or use it for any purpose nor disclose or
>> distribute its contents to any other person.
>> ********************************************************************
>>
>>
>
>

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 9 Apr 2013 12:23:02 -0700

AB,

On Tue, Apr 9, 2013 at 8:20 AM, Abdussalam Baryun
<[email-masked]> wrote:
>[...]

What do you mean by physical attacks? Tampering with the hardware of
the router running NHDP? I think that this is not the scope of the
draft (and also irrelevant); the draft purely looks at security
threats of misconfigured or malicious NHDP routers that misbehave when
using NHDP. It could be that such a router has been hacked via an
implementation flaw or physically exchanged some parts of the
hardware; that does not matter. For the case you describe, how does it
matter if the router disappears and comes back later? (whether or not
it is physically exchanged, or just stopped sending HELLOs for a
while).

Regards
Ulrich

> [...]

---

From: Abdussalam Baryun <[email-masked]>
Date: Tue, 9 Apr 2013 22:54:35 +0200

The main point was not the *physical attack*, the main point is that
the I-D discusses only when the malicious node is not in range of the
identity node that it is spoofing. I think that an attacker may be
spoofing even if it was in radio coverage when the neighbor is
disapeared.

AB

---

From: Daniel He <[email-masked]>
Date: Tue, 9 Apr 2013 22:11:57 +0100

No. They don't need to define what is the attack means.
Refer to ISO 27001:2005 which has clearly defined every terminologies.

and again physical attack is out of scope to what we are doing
information security at protocol levels!

Cheers,
Daniel

On 9 April 2013 21:54, Abdussalam Baryun <[email-masked]> wrote:

> >>> providing here where one good source of definitions. Whether to
> reference
> >>> it
> _______________________________________________
> manet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/manet
>

---

From: "Adrian Farrel" <[email-masked]>
Date: Tue, 9 Apr 2013 22:22:01 +0100

Personally, I think this misinterprets "spoofing". You don't spoof a node, you
spoof packets so that they appear to have come from a node.
A

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Abdussalam Baryun
> Sent: 09 April 2013 21:55
> To: Ulrich Herberg
> Cc: draft-ietf-manet-nhdp-sec-threats; manet
> Subject: Re: [manet] AB#3 Comments for WGLC draft-ietf-manet-nhdp-sec-
> threats-02
>

---

From: Abdussalam Baryun <[email-masked]>
Date: Wed, 10 Apr 2013 00:36:34 +0200

Ok, the main point of the comment is that the examples of section
4.4.1 only considers when the malicious node using identity of another
that is not in range, I hope the editors include scenarios that there
is a threat even if in the radio range when also the malicious node
aware when that node is in sleep mode or malfunction.

The condition of same radio range does not stop the NHDP threat in my
opinion, if you think it does please advise. This AB#3 comment
suggested considering the scenario of same coverage for neighbors but
possible spoof,

AB

On 4/9/13, Adrian Farrel <[email-masked]> wrote:
>> >>> I'm neither recommending that a reference is included or excluded,
>> >>> I'm
>> >>> just

---

From: Ulrich Herberg <[email-masked]>
Date: Tue, 9 Apr 2013 16:41:47 -0700

The draft does not say that identity spoofing is only applicable when
the malicious node is not in direct communication range with the
router it spoofs the address of outgoing messages.
Read:
Figure 1 depicts a ***simple example***.  In that ***example***, NHDP
   router A is in radio range of C, but not of the Compromised NHDP
   router X.

This is just for illustration purposes and in particular because it is
extended in the following example in figure 2. Router A and X could
also be in radio range, it would still be identity spoofing (and
nothing of the description of the attack in the paragraphs before the
two examples indicate any requirement about being in radio range or
not).

---

From: Abdussalam Baryun <[email-masked]>
Date: Wed, 10 Apr 2013 02:23:06 +0200

It is clear from the I-D section 4.4.1 that the section only considers
A is not in radio range of X, I don't know how you can say A and X
could be in range in Fig.2, there is no line and they are far away, it
mentions that A uses hops to reach. I ment in my scenario that D, X
and A may be in same radio coverage (only one hop) and that still may
have threats to NHDP, this not represented.

 If you see the link line between each node-to-node you notice that
radio range means there is a line between them. If you recall seeing
Fig.3 to know how the authors describe range and lost,

AB

On 4/10/13, Ulrich Herberg <[email-masked]> wrote:
>>> Personally, I think this misinterprets "spoofing". You don't spoof a
>>> node,
>>> you
>>>> >>>> potential cause of an unwanted incident, which may result in harm
>>>> >>>> to
>>>> >>>> a
>>>> >>>> system or organization
>>>> >>>>
>>>> >>>> 2.4
>>>> >>>> attack
>>>> >>>> (The rules are that you may substitute in the definition, so
>>>> >>>> attack
>>>> >>>> may
>>>> >>>> be