Subject: Re: [Mip6] New I-D: Early Binding Updates for Mobile IPv6

From: "Christian Vogt" <[email-masked]>
Date: Thu, 12 Feb 2004 13:24:01 +0100

Hi Brian,

my comments are between the snippets. You will find the complete email that I am referencing below.

> > Again, with Early Binding Updates, the attacker's yield is a data stream
> > towards the victim of TENTATIVE_BINDING_LIFETIME seconds' length. Isn't 
> > this yield too little to make the flooding attack a "success" (from the 
> > attacker's point of view)? 

> But I can continue to extend this lifetime by just sending more EBUs.

This is true: Here is where policies must come into force. In a nutshell, the CN should not allow more than one pending EBU per home address. The I-D mentions this briefly. Let me try to get into more depth here.

Recall that, when a CN receives an EBU message, the CN knows that the EBU message's home address is correct. This is because a home-address test had to be done in order to authenticate the EBU message. Thus, the CN can identify the sender of the EBU message.

Here is a simple policy that a CN might use to curb the threat of flooding attacks: When the CN receives an EBU message with home address HoA and care-of address CoA, the CN creates a tentative binding-cache entry mapping HoA to CoA. The CN expects to receive a standard BU message confirming this mapping before the tentative binding-cache entry expires. (The I-D proposes that expiration happens after TENTATIVE_BINDING_LIFETIME seconds = 3 seconds.)

If the CN does NOT receive the standard BU before the tentative binding-cache entry expires, the CN puts HoA on a black list. The CN will not accept EBUs with home address HoA until it receives a properly authenticated, standard BU message with home address HoA. (Obviously, black-list entries have to expire after a while. Yet, discussing what an appropriate expiration timeout could be would go to far now.)

Furthermore, when the CN recognizes that it is running out of memory, the CN does no longer accept EBUs with any home address. Monitoring resources, however, is not an EBU-specific behavior. An optimized CN would probably do this anyway. The CN returns to normal mode when sufficient resources have been freed up.

The outlined policy is a countermeasure against flooding attacks. One may argue that EBUs can be used to purposely occupy the resources of a CN as well, effectively waging a denial-of-service attack against the CN. To some extent, this is true. The point is that an EBU must be *authenticated* in order to occupy resources at the CN. (Again, a home-address test had to be done in order to authenticate the EBU message.) This kind of denial-of-service attack is possible in standard Mobile IPv6 as well.

> > Brian, you mention that the attacker could exploit thousands of CNs
> > for its attack. Yet, the more CNs are being exploited, the more state
> > the attacker will have to maintain. 

> If I use ICMP Echo Request I don't need to store any state.

ICMP-Echo-Request flooding is not a Mobile-IPv6-specific attack. An attacker can do this in static IPv6.

Best regards,

- Christian

|
| Christian Vogt
| Institute of Telematics, University of Karlsruhe (TH)
| www.tm.uni-karlsruhe.de/~chvogt/
|

----- Original Message ----- 
From: "Brian Haley" <[email-masked]>
To: "Christian Vogt" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Wednesday, February 11, 2004 5:33 PM
Subject: Re: [Mip6] New I-D: Early Binding Updates for Mobile IPv6

> Hi Christian,
> 
> > Right now, I see two styles of flooding attacks which are related
> > to our discussion: simple redirection of data and the combination
> > of data redirection and amplification.
> > 
> > (1) Simple redirection attacks: An attacker sends a packet to a CN.
> > The packet's IP Source Address is spoofed: It contains the IP address
> > of an attacked node, say, the victim. The packet is such that the CN
> > responds to the victim with a packet of (approximately) the same size.
> > This kind of flooding attack could be the well-known TCP-SYN-flooding 
> > attack. It could also be an ICMP-Echo-Request (Ping) flooding attack. 
> > Either way, this kind of attack is possible with normal IPv6, i.e., 
> > even without Mobile IPv6!
> 
> > Now, Early Binding Updates come into play. Having shaken hands with the
> > CN, the attacker redirects the data flow towards the victim with the help
> > of an Early Binding Update message. This data stream will hold for at
> > most TENTATIVE_BINDING_LIFETIME seconds. (TENTATIVE_BINDING_LIFETIME 
> > defaults to 3 seconds; one may - and probably should - reduce this time.)
> 
> Yes, I understand that there are attacks that can be made with "regular" 
> IPv6 and Mobile IPv6, but you are creating another possibile scenario, 
> which I wanted to make clear.  The WG would have to decide if it's worth 
> the risk.
> 
> > Again, with Early Binding Updates, the attacker's yield is a data stream
> > towards the victim of TENTATIVE_BINDING_LIFETIME seconds' length. Isn't 
> > this yield too little to make the flooding attack a "success" (from the 
> > attacker's point of view)? 
> 
> But I can continue to extend this lifetime by just sending more EBUs.
> 
> > I think what is most important is the relation between the attacker's yield
> > and the attacker's "investments" in terms of state and handshaking overhead.
> > 
> > Brian, you mention that the attacker could exploit thousands of CNs for its
> > attack. Yet, the more CNs are being exploited, the more state the attacker
> > will have to maintain. 
> 
> If I use ICMP Echo Request I don't need to store any state.
> 
> I will have to read Francis' drafts when they come out to see how they 
> relate to yours.
> 
> Regards,
> 
> -Brian

Šž¦j)bž	b²Ó"§¨žµú+‚m¦ÏÿÃ"z×è®æj)fjåŠËbú?š*z