Subject: RE: [Mobike] issue 34 proposal

From: [email-masked]
Date: Tue, 20 Sep 2005 21:01:35 -0400

But, couldn't an attacker capture an ESP packet, change the src ip /
port, and force us to start sending/flooding packets to an un-suspecting
IP addr?

At least a RR test would tell us that our 'peer' can indeed recv packets
on the new IP.  Still has MitM issues on the RR, mind you...

Stephane.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] 
> Sent: Tuesday, September 20, 2005 6:27 AM
> To: Stephane Beaulieu [[email-masked]]
> Cc: [email-masked]; Tero Kivinen; Jari Arkko; 
> [email-masked]
> Subject: Re: [Mobike] issue 34 proposal 
> 
>  In your previous mail you wrote:
> 
>    If one does detect NAT change at ESP layer, what does one do?
>    
>    Do we do a return routability check on the new address 
> before updating
>    it's SADB?  It would seem logical, but just want to make 
> sure we're on
>    the same page.
>    
> => this is not logical at all! The SADB should be updated 
> ASAP and the RR check doesn't help at all: it only adds 
> delay, if the new address is bad the next packet with a good 
> address will fix the SADB.
> 
> Regards
> 
> [email-masked]
> 
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Wed, 21 Sep 2005 10:28:49 +0200

=> yes but by definition a NAT is out of control (if you can control it
the first thing you'll do is to remove it :-) so:
 - the implicit update is its own defense, i.e., either it is not supported
   and the attack doesn't work, or it is supported and the first good packet
   from the node behind the NAT will fix the address
 - the pseudo-NAT can simply move the direct (i.e., not reflected) traffic
   to a third party

   on the new IP.

=> not really as:

   Still has MitM issues on the RR, mind you...
   
=> IMHO it is better to rely on ingress filtering:
 - when it is deployed, it catches the same attacks than RR
 - when it is not deployed, the attackers have already too many
   simpler possibilities as the real world can prove everyday...
So I think that most of RR "requirements" are only FUD.

Thanks