RE: Some RDDP attacks

 
I agree with Caitlin - once you've figured out the right values in TCP (i.e. "forge a packet"), TCP allows you to reset the connection without ever dealing with DDP/RDMAP - just send a RST segment. Thus I don't see how solving this in DDP/RDMAP changes the exposure.
 
As is noted in the following ID, this is viewed as non-trivial, but possible.
 
http://www.ietf.org/internet-drafts/draft-ietf-rpsec-bgpattack-00.txt, section 2.1.6 "Reset a single BGP Session".
 
 
 
jim
 
 

________________________________

From: Caitlin Bestler [mailto:[email protected]]
Sent: Thu 7/8/2004 6:20 AM
To: RDDP
Cc: David Black; Jim Pinkerton
Subject: Re: [rddp] Some RDDP attacks




On Jul 5, 2004, at 1:50 PM, [email protected] wrote:

>
>> If we took a moment to look at the packet header for DDP for how a
>> malicious user that has successfully guessed the SCTP/TCP transport
>> parameters can effect the connection, there is actually a far simpler
>> attack than guessing the 32 bit STag value - and the attack abortively
>> terminates the connection and thus truncates the data stream. Use
>> untagged messages with just about any MSN, and the receiver will get a
>> "no buffers available" error and tear down the connection. Thus
>> claiming
>> the STag is a risk actually ignores a much easier attack.
>
> I think that's actually indicative of a DDP problem, in that the
> current
> DDP draft is too quick to close a connection when receiving anything it
> doesn't expect.  Mandating "silent drop" rather than "tear down the
> connection" would make this attack significantly harder to pull off.

If you can forge a TCP packet within the TCP window you can force the
connection to close. No RDDP Layer capabilities are required. This is
also true for SCTP, although forging a valid packet is slightly harder.

_______________________________________________
rddp mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/rddp