Subject: Re: [core] #167: IP address spoofing threat analysis

From: "core issue tracker" <[email-masked]>
Date: Mon, 24 Oct 2011 11:44:55 -0000

#167: IP address spoofing threat analysis

Changes (by zach@…):

 * status:  new => closed
 * resolution:   => fixed

Comment:

 The following section was added to the draft.

 10.3.4. IP Address Spoofing Attacks

     Due to the non-reliability of UDP (and to some extent to the
     duplicate message processing strategy), a rogue endpoint which is
     free to read and write messages carried by the constrained network
     (i.e. NoSec? or PreSharedKey? deployments with nodes/key ratio > 1:1),
     may easily attack a single endpoint, a group of endpoints, as well as
     the whole network e.g. by:

     spoofing RST in response to a CON message, thus making an

         endpoint "deaf"; or

     spoofing the entire response with forged payload/options (this

         has different levels of impact: from single response disruption,
         to much bolder attacks on the supporting infrastructure, e.g.
         poisoning proxy caches, or tricking validation / lookup
         interfaces in resource directories and, more generally, any
         component that stores global network state and uses CoAP as the
         messaging facility to handle state set/update's is a potential
         target.); or

     spoofing a multicast request for a target node which may result

         in both network congestion/collapse and victim DoS'ing / forced
         wakeup from sleeping; or

     spoofing observe messages, etc.

     In principle, spoofing can be detected by CoAP only in case CON
     semantics is used, because of unexpected ACK/RSTs coming from the
     deceived endpoint. But this imposes keeping track of the used MIDs
     which is not always possible, and moreover detection becomes
     available usually after the damage is already done. This kind of
     attack can be prevented using PreSharedKey? (with a 1:1 node/key
     ratio) or Certificate security modes.

-- 
--------------------+---------------------
 Reporter:  zach@…  |       Owner:  zach@…
     Type:  task    |      Status:  closed
 Priority:  minor   |   Milestone:
Component:  coap    |     Version:
 Severity:  -       |  Resolution:  fixed
 Keywords:          |
--------------------+---------------------

Ticket URL: <http://trac.tools.ietf.org/wg/core/trac/ticket/167#comment:1>
core <http://tools.ietf.org/core/>

---

From: Thomas Fossati <[email-masked]>
Date: Mon, 24 Oct 2011 20:20:08 +0200

> 10.3.4. IP Address Spoofing Attacks

Thank you Zach, much appreciated.

If you need to refine the text, I'm willing to contribute.