Subject: [mobile-ip] HA compromises

From: Asad Samar <[email-masked]>
Date: Wed, 24 Oct 2001 15:37:44 -0400 (EDT)

Hi People

I have a small question about the security in MIPv4

What happens if the home agent is compromised? Say I am running a
webserver on my laptop (hard to believe but possible) and my home agent is
over taken by some malicious user which denies stops forwarding all
packets destined to me from the web clients.

Seems like some sort of mechanism for detecting a bad HA and dynamically
deploying a new home agent in the home network would be useful. Has anyone
worked on something like this? I couldnt find any hint of such a mechanism
in the MIPv4 rfc...am I missing something big?

A quick reply will really help.
Thanks
Asad

On Sun, 21 Oct 2001, Henrik Petander wrote:

> Hi Asad,
>
> On Sat, 20 Oct 2001, Asad Samar wrote:
>
> > Hi Henrik
> >
> > We got your reference from the email below.
> > Are there still some issues with MIPv6 which can result in a DDOS attack?
>
> Yes, but probably most will be fixed before MIPv6 becomes an RFC.
>
>
> >
> > We read the threat model document being discussed these days on the MIP
> > email list and seems like the answer to all of their questions is
> > authentication. Are you dealing with issues which cannot be solved even by
> > authentication in MIPv6? We will be grateful if you can give us some
> > hints.
>
> I am personally focusing on the authorization of Binding Updates which,
> especially when used for route optimization, is IMO the most important
> security issue with Mobile IPv6. If this issue is solved properly
> (authorization of keys used for BUs/BAs, authentication, integrity and
> replay protection for BUs/BAs, then also the vulnerabilities related to
> DOS attacks will be mostly limited to the general wireless / IPv6 ones.
> Some exceptions: (there may also be other ones that I can't remember right
> now)
>
> Home Address option opens vulnerabilities in CNs to reflection attacks.
> Pekka Savola has analyzed the vulnerabilities Home Address option creates
> in CNs in a draft. He also speaks about routing header, which is not
> exactly a MIPv6 mechanism.
>
> MN will probably use some wireless technology with limited bandwdth, which
> makes it vulnerable to clogging attacks. This is not actually a MIPv6
> specific problem, but a more general problem related to wireless
> networking. However, the tunneling of packets from HA to MN could
> allow an attacker to bypass packet filtering rules in the foreign network.
>
> If there is no firewall in the home network, then these two factors could
> make MN vulnerable to DoS attacks. The reverse situation of a FW in home
> network and no FW in foreign network also creates vulnerabilities in
> MN, since it can be attacked through its care-of address, which the
> attacker can learn through triangle routing. I think the latter is the
> more important vulnerability, i.e, a laptop normally behind a strict
> firewall goes mobile and is suddenly reachable by anyone who can learn
> its CoA.
>
> Regards,
> Henrik
>
> >
> > Thanks
> > Asad
> >
> >
> > ---------- Forwarded message ----------
> > Date: Tue, 16 Oct 2001 16:06:05 -0700
> > From: Jari T. Malinen <[email-masked]>
> > To: Charlie Perkins <[email-masked]>
> > Cc: Asad Samar <[email-masked]>, Humayun Latif <[email-masked]>,
> >      Brenda Liu <[email-masked]>
> > Subject: Re: Mobile IP
> >
> > Hello,
> >
> > Back when at Helsinki U of Technology, Jouni K. Malinen wrote
> > a set of exploits for MIPv4, but it was not turned into a study
> > nor were these exploits made available to the public.
> >
> > One of these considered the case when there is a cooperating
> > attacking MN and HA, one sending a registration request on behalf
> > of the snooped MN on its link and a cooperating HA responding with
> > a valid reply, say, from the victim's home link, or from elsewhere.
> > A visitor list (binding cache) entry can be thus modified
> > in the FA on behalf of the victim MN to point to a wrong HA thus
> > disrupting communication. This is a DDOS if, say, the FA does not
> > accept reg.replies from the same port where the attacking MN is,
> > otherwise the MN can also play the cooperating HA and send itself
> > the registration reply with a success status.
> >
> > You can ask more from the Dynamics mailing list, info how to join
> > you can find via http://www.cs.hut.fi/Research/Dynamics/
> >
> > Another HUT person doing security work is Henrik Petander,
> > [email-masked], he is writing his M.Sc. on MIPv6 security,
> > you might ask from him, too.
> >
> > BR,
> >
> > -Jari
> >
> > Charlie Perkins wrote:
> > >
> > > Hello folks,
> > >
> > > I am myself not aware of such a testbed as you have described,
> > > but I would recommend that you join the mobile-ip mailing list
> > > (from the IETF working group) and ask the question there.
> > > If someone has a testbed, you'll most likely get an answer.
> > > I am also not aware of any related attempt to simulate such
> > > a DDOS attack in a simulated mobile environment.
> > >
> > > Regarding the usefulness for DDoS attacks, though, I am not
> > > so sure!  It's a matter of creativity to mount such attacks, not
> > > necessarily randomness, so I don't know what you might try
> > > to measure.
> > >
> > > I've CC:'d Jari Malinen on this note, in hopes that he might
> > > have a lead for any related work from his cohorts at HUT
> > > (Technical Univervsity of Helsinki).
> > >
> > > Regards,
> > > Charlie P.
> > >
> > > Asad Samar wrote:
> > >
> > > > Hi Charles
> > > >
> > > > We are a group taking the Advanced OS and Distributed Systems course at
> > > > CMU. We are thinking about modeling DDOS (distributed denial of service)
> > > > attacks in the mobile environment, specifically in the context of mobile
> > > > IP for our semster project.
> > > >
> > > > >From what we know so far, there doesnt seem to be too much information
> > > > available in this domain. Since you have been involved in Mobile-IP from
> > > > the beginning we just wanted to get your input and any experience or
> > > > pointers you have that might be helpful.
> > > >
> > > > Something really useful would be a way to setup some sort of a testbed
> > > > where we can possibly emulate such an attack. If you have any
> > > > code/development-kits/pointers in this respect that will be very useful.
> > > >
> > > > Are you aware of anyone who has worked in this area at all? We know people
> > > > have tried to solve some of the problems in the protocol but was there an
> > > > extensive study of modeling these concerns (launching a DDOS attack in a
> > > > mobile environment) in the first place? We will greatly appreciate any
> > > > hints on that.
> > > >
> > > > Thanks
> > > > Asad~Brenda~Humayun
> >
>
> 		----------------------------------
> 		Henrik Petander
> 		Helsinki University of Technology,
> 		GO/Core Project
> 		[email-masked]
> 		Office: +358 (0)9 451 5846
> 		GSM: +358 (0)40 741 5248
> 		----------------------------------
>
>
>

---

From: Michael Thomas <[email-masked]>
Date: Wed, 24 Oct 2001 12:48:10 -0700 (PDT)

> packets destined to me from the web clients.

I'd say that it's pretty much the same as if your
first hop router was compromised. In other words,
bad.

 > in the MIPv4 rfc...am I missing something big?

This depends on the compromise. If somebody breaks
into the HA, then it will still most likely have
all of the keying material and trust relationships
as before and would be undetectable by the MN. For
other attacks, strong authentication should be
used to defeat MITM and rogue HA attacks, but this
isn't any different than initial mutual
authentication.

	  Mike

---

From: Asad Samar <[email-masked]>
Date: Wed, 24 Oct 2001 17:28:47 -0400 (EDT)

> first hop router was compromised. In other words,

True...but the question is if we can do something to help the "compromised
HA" situation which we can (possibly) not do in the router case.

For instance, maybe a MN sends periodic control packets to its home
address to see if they are tunnelled back to it by the HA or not. A
compromised HA can atmost block the packets and not alter them because I
was assuming some integrity checks (digital signatures etc). So if we can
sense (using whatever means) some packets being lost/stopped by the HA
because of a technical fault or malicious intent; will it be useful to
dynamically deploy another HA in the home network and have that tunnel the
packets?

Asad