Subject: [mobile-ip] specific comments/text for RH/HA in SecReqs

From: Pekka Savola <[email-masked]>
Date: Fri, 19 Oct 2001 10:53:55 +0300 (EEST)

Hello all.

I've tried to put up some specific text on how SecReqs could be enhanced.  
This is not meant to be exclusive of other comments on the subject here, 
just a start.

(btw. I tend to agree with Chalie that the draft is not as clear as it 
could be typographically.  For example, I had no idea whether 
"Classification of attackers" (both parts), threats, the summary table, 
the threat letters and numbers etc. were supposed to correlate somehow).

Most of this would probably need some enhancements, but it's a start I 
hope.

--8<--
3.  Threats on a broad scope introduced by Mobile IPv6
   
==>

Home Address option introduces mostly DoS-related threats against all IPv6
nodes whether mobile or not.  Threat H.3 discusses these.

All MN's must process routing header.  Routing header processing rules   
[RFC2460] implementation should be refined to account for "node-local" 
routing headers.  Unless this is done, it is probable that the processing
of all routing headers is enabled on MN's, possibly on stationary nodes
too.  This is discussed in H.4.

5.  Classification of Attackers

   The following classes of attackers, and threats caused by them, are
   considered:

   -  an arbitrary node, anywhere in the Internet, launching an attack 
      gainst a MN, a CN, or a HA
==>
   -  an arbitrary node, anywhere in the Internet, launching an attack
      against a MN/CN/HA or any IPv6 node implementing MIPv6 features
      (e.g. Home Address option processing)
   
   -  an arbitrary node, anywhere in the Internet, launching an attack
      abusing MIPv6 features against any node in the Internet using a
      MN/CN/HA or any IPv6 node implementing MIPv6 features as a proxy

   Furthermore, we consider the following threats separately:
   
   -  using a previous router as a temporary HA
   
   -  DoS attacks against a CN
   
   -  DoS attacks against a MN

   -  DoS attacks against a HA
   
==>
   -  DoS attacks against any IPv6 node implementing MIPv6 features (like
      Home Address option processing)
   
   -  (DoS attacks against any IPv6 node in the Internet, abusing a node
       which implements MIPv6 features)

6.8.  Other threats, including those that target the Home Agent

H.3.  Use any IPv6 node as a packet reflector

s/CN/any IPv6 node/.

+ and comments in thread ' MIPv6 HA wording and H.3 of SecReqs' earlier.

H.4.  Use MN or any IPv6 node to avoid firewalls and reflect traffic

Scenario H.4:

All mobile nodes must process routing header.  Having to enable routing
header processing for everyone in the Internet is dangerous as it can be
used to reflect traffic and to get around packet filters' access lists
[RHHASEC].

Requirement H.4:

To enable routing header processing for the Home Address assigned on the
same node, it MUST NOT be required for MN to require all routing headers
would be processed and corresponding packets forwarded.

There SHOULD be some form of authorization in the node to forward to the  
specified addresses in the routing header if global routing header
forwarding is disabled.

Threat H.4:

Especially DoS attacks could be routed through CN to lay false trails
which would be it easier for the attacker to hide itself.

Packet filter access lists can be exploited as the destination address is
being rewritten when the packet traverses the network.  This could lead to
security disclosures and unauthorized access.
--8<--

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords