Subject: [savi] A quick review of SAVI threat scope document

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Tue, 19 Oct 2010 16:42:08 +0200

After a quick (and late) review of the SAVI threat scope document here are some comments:
- while the I-D documents in a detailed, well-done and analytical way several attacks (such as the good old LAND), I wonder whether it sets the right scene as SAVI works mainly in a layer-2 environment. It also seems that the focus of the I-D is on ISP while SAVI focus on any network.
- 3.1.2 perhaps worth mentioning attacks against the control plane?
- generic: replace 'today Internet' by 'Internet in 2010'
- 3.1: to be complete, I would have hoped to see blind TCP hijacking with the mention 'very complex to mount is TCP ISN are random'
- 3.2.1: should rather use NDP spoofing than ARP spoofing :-)
- 3.2: should really include content modification / dropping connection
- perhaps worth mentioning that DAD attack can cause a DoS in the threat section?
- 4 in general should be split in two sections: one on topology (4.1-4.7) and one on solution (4.8-4.12)
- 4. Figure 1: usually a edge network such as edge network 1 also contains several internal routers (which are described in 4.2)
- 4.1 and other places: there is ambiguity about 'spoofed address' is it layer-2? Is it layer-3 address?
- 4.5 is not crystal clear (other sections are really clear and easy to understand). Also shared medium is usually but not always associated to LAN (switches, WLAN with WPA). Change of vocabulary is also happing MAC address rather than Link Address
- 4.6 (I am not the DOCSIS expert) but I believe that DOCSIS use a per MAC address encryption key, so, MAC spoofing is more difficult. Can be wrong on this comment :-)
- 4.7 is more complex as expressed by Broadband Forum reports, DSLAM are known to do MAC translation...
- 4.10 'SAVE appears to be initially' seems a strange working IMHO for an WG I-D
- 5.2 I would replace 'are problematic' by 'the traffic from those devices cannot be verified in depth'
- 5.2.3 'blade server' should probably be explained to the reader and 'machine' should be expanded into 'virtual machine'
- 5.3 'ID' -> 'IID'
- 6 English is not my native language, but, I find that 'these threats can be ameliorated' quite confusing

Hope it helps

-éric