Subject: Re: [dnssd] Multicast DNS (mDNS) Threat Model and Security Consideration

From: Douglas Otis <[email-masked]>
Date: Sun, 10 May 2015 14:27:52 -0700

On 4/15/15 1:34 AM, Albrecht, Harald wrote:
> Another thing that strikes me is the use of "GUA address" and "ULA address". The "A" in "GUA" and "ULA" already means address, so "GUA address" basically means a "global unicast address address". Either a sole "GUA"/"ULA" is already sufficient or always spell "global unicast address" in full.
>
> With respect to section 3.7.1 "Storing mDNS names in unicast DNS" I wonder if there are attacks possible based on leaking UTF-8 labels into unicast DNS and thus upsetting either DNS servers, (stub) resolvers, and IDNA libraries?
>
> In section 3.13.4.1 what is the security standpoint rationale to not publish GUAs? For instance, if a site decides to not use ULAs but only GUAs (believe me, there are such huge sites in IPv4 that run their company intranet on global addresses, not on private ones) then this would not be less secure than using ULAs. Some moments before the draft argues with respect to ULA accessibility. The same also applies to GUAs. Not publishing something doesn't mean it's not reachable - this would be a perfect example of security by obscurity. And security by obscurity is known to not offer any security at all. So, please detail the rationale behind 3.13.4.1 and it focusing on ULA only.
>
Dear Harald,

https://tools.ietf.org/html/draft-otis-dnssd-mdns-xlink-05#section-3
attempts to clarify differences between GUA and ULA based on
the definition by
https://tools.ietf.org/html/rfc4193#section-3.2
An addendum was added to better illustrate the risks.  Notes
collected in creation of
https://www.kb.cert.org/vuls/id/550620
also clarifies addition threats.  Somehow the cert link
failed to expand properly.  Will fix, but Google will also
resolve based on the link title.

Regards,
Douglas Otis