Re: Some RDDP attacks

On Jul 5, 2004, at 1:50 PM, [email protected] wrote:

>
>> If we took a moment to look at the packet header for DDP for how a
>> malicious user that has successfully guessed the SCTP/TCP transport
>> parameters can effect the connection, there is actually a far simpler
>> attack than guessing the 32 bit STag value - and the attack abortively
>> terminates the connection and thus truncates the data stream. Use
>> untagged messages with just about any MSN, and the receiver will get a
>> "no buffers available" error and tear down the connection. Thus 
>> claiming
>> the STag is a risk actually ignores a much easier attack.
>
> I think that's actually indicative of a DDP problem, in that the 
> current
> DDP draft is too quick to close a connection when receiving anything it
> doesn't expect.  Mandating "silent drop" rather than "tear down the
> connection" would make this attack significantly harder to pull off.

If you can forge a TCP packet within the TCP window you can force the
connection to close. No RDDP Layer capabilities are required. This is
also true for SCTP, although forging a valid packet is slightly harder.