Subject: [multipathtcp] A reasonable attacker model

From: Olivier Bonaventure <[email-masked]>
Date: Mon, 22 Nov 2010 16:04:26 +0100

Hello,

A first point that I'd like to discuss is to have a reasonable model of
the expected capabilities of an attacker. Without an attacker model, I
don't think that it is possible to discuss the securisation of a
protocol such as MPTCP. Here are some possible attackers

Blind and non-spoofable attacker

	This attacker can send MPTCP packets with its own IP address but cannot
capture any of the packets sent by either of the communicating hosts.

Blind and spoofable attacker

	This attacker can send MPTCP packets with both its own IP address and
at least one of the IP addresses of the communicating hosts. However, it
cannot listen to the packets exchanged by the communicating hosts.

Listener and non-spoofable attacker

	This attacker can send MPTCP packets with its own IP address, and can
listen to the packets sent and received by at least one of the
communicating hosts. Such an attacker may in practice be only able to
capture packets on some of the subflows not all of them.

Listener and spoofable attacker

	This attacker can send MPTCP packets with its own IP address and at
least one of the IP addresses of the communicating hosts. It can listen
to the packets sent and received by at least one of the communicating
hosts. Such an attacker may in practice be only able to capture packets
on some of the subflows not all of them.

Blind attacker that obtains an address

	This attacker can send MPTCP packets with its own IP address but has
been allocated an IP address that was assigned shortly before to one of
the communicating hosts.

Man-in-the-middle attacker

	This attacker can intercept the MPTCP packets sent by a host and modify
them before forwarding them to the other communicating host.

There are probably other types of attackers that are possible. I think
that we should explicitly document them in an mptcp security draft.

This distinction among the attackers can be extended in two directions :
- time : an attacker may be of type x at the beginning of an mptcp
connection and later become of type y
- subflows : an attacker may be of type x for the packets exchanged over
one subflow and of type y for the packets exchanged over another subflow

I guess that we all agree that mptcp will not be secure against a
man-in-the-middle attacker, but should it be secure for the other types
of attackers ?

Olivier

-- 
INL, ICTEAM, UCLouvain, Belgium, http://inl.info.ucl.ac.be

---

From: "McDonald, Andrew" <[email-masked]>
Date: Tue, 30 Nov 2010 13:01:38 +0000

Hi Olivier,

> protocol such as MPTCP. Here are some possible attackers

Yes, having an adversary model is useful to understand the feasibility 
of particular attacks, and so the effects of particular protocol 
mechanisms designed to secure MPTCP.

[snip]
> capture packets on some of the subflows not all of them.

In the case of listeners, they might further be divided into those that 
can see one or both directions, and those that see all or just a subset 
of packets. (The latter might just be a special case of the 'being type 
x attacker at particular time(s)'.)

> been allocated an IP address that was assigned shortly before to one of

I was thinking about these two attackers and trying to work out what the 
difference was between:
- attacker can spoof a 'victim' IP address, and
- attacker acquires ownership of an IP address that had belonged to a 
'victim'.
I think the interesting difference is not so much that the attacker has 
acquired the address, but rather that the 'victim' has lost control of 
it. Although the 'Listener and spoofer' can send packets, responses will 
end up going to the victim (and they might be able to do something to 
block the attack as a result of seeing these). However, the 'address 
acquirer' gets the (only copy) of the responses sent to that IP address.

Would it be useful to cross-reference these attackers against the 
scenarios in the threat model draft?

regards,

Andrew