Subject: [Roll] [roll] #152: draft-ietf-roll-security-threats - Add further clarification/information - Section 5

From: "roll issue tracker" <[email-masked]>
Date: Sun, 23 Feb 2014 20:06:06 -0000

#152: draft-ietf-roll-security-threats - Add further clarification/information -
Section 5

 Reported by Robert Cragie - 02/17/2014

 * Section 5 Threats and Attacks

 The source of the attacks is assumed to be from either inside or outside
 attackers.  The capability these attackes may be limited to node-
 equivalent, but also to more sophisticated computing platforms.

 <rcc>The above sentence is difficult to read and understand ("node-
 equivalent"?)</rcc>

 * Section 5.1.  Threats due to failures to Authenticate

 <rcc>I would say these are more consequences for the routing process than
 threats</rcc>

 * Section 5.1.1.  Node Impersonation

 If an attacker can join a network with any identify,

 <rcc>What does "join a network with any identify" mean?</rcc>

  In other systems where there is separate application layer security, the
 ability to impersonate a node would permit an attacker to direct traffic
 to itself, which facilitates on-path attacks including replaying,
 delaying, or duplicating control messages.

 <rcc>I don't understand the distinction for separate application layer
 security wrt. directing traffic to itself. Moreover, the intra-asset
 security domains outside of the control plane have not been clearly
 identified at this point</rcc>

 * Section 5.1.2.  Dummy Node

    If an attacker can join a network with any identify,

 <rcc>What does "join a network with any identify" mean?</rcc>

 then it can  pretend to be a legitimate node, receiving any service
 legitimate
 nodes receive.  It may also be able to report false readings (in metering
 applications), or provide inappropriate authorizations (in control systems
 involving actuators), or perform any other attacks  that are facilitated
 by being able to direct traffic towards itself.

 <rcc>How is this different from 5.1.1?</rcc>

 * Section 5.1.3.  Node Resource Spam

    If an attacker can join a network with any identify,

 <rcc>What does "join a network with any identify" mean?</rcc>

    then it can continously do so, draining down the resources of the
 network to  store identity and routing information, potentionally forcing
 legitimate nodes of the network.

 <rcc>End of sentence seems to be missing</rcc>

 * Section 5.2.1. Routing Exchange Exposure

    Routing exchanges include both routing information as well as
 information associated with the establishment and maintenance of neighbor
 state information.  As indicated in Section 3.1, the
    associated routing information assets may also include device  specific
 resource information, such as memory, remaining power, etc.,  that may be
 metrics of the routing protocol.

 <rcc>Not sure how "memory" can be a metric of a routing protocol? Does
 this mean "available memory"?</rcc>

 * Section 5.2.2.  Routing Information

 The exposure of this information will allow attachers to gain direct
 access to the configuration and connectivity of the network thereby
 exposing routing to targeted attacks on key nodes or links.  Since routes
 and neighbor topology information is stored within the node device,threats
 or attacks on the confidentiality of the information will apply to the
 physical device including specified and unspecified internal and external
 interfaces.

 <rcc>Can't really have a "threat on" something - an attack is a physical
 realization of a threat. Can have a "threat to" something, which means
 that a threat is nascent and is not realized until processed into an
 attack</rcc>

 Both of these attack vectors are considered a device specific issue, and
 are out of scope for RPL to defend against.  In some applications,
 physical device compromise may be a real threat and it may be necessary to
 provide for other devices to react quickly to exclude a compromised
 device.

 <rcc>Exclusion can only be done when a compromised device can be
 authentically detected otherwise this could form another attack vector,
 i.e. an attacker could try to convince Node A that Node B is compromised
 when Node B is actually functioning correctly. Also, this is general
 compromise, not just that associated with breach of confidentiality</rcc>

 * Section 5.3.1. Routing Information Manipulation

      o  Falsification, including overclaiming and misclaiming;

 <rcc>Probably worth explaining what "overclaiming" and "misclaiming"
 mean</rcc>

 ...

    o  Byzantine (internal) attacks that permit corruption of routing
       information in the node even where the node continues to be a
       validated entity within the network (see, for example, [RFC4593]
       for further discussions on Byzantine attacks);

 <rcc>Isn't that also falsification? Degrees of subtlety to falsification
 may be worth highlighting; subtle changes would be done to avoid
 detection</rcc>

 * Section 5.3.2. Node Identity Misappropriation

    o  Identity attacks, including Sybil attacks in which a malicious node
 illegitimately assumes multiple identities;

 <rcc>Assumption is that a Sybil attack is an intelligent attack where a
 device can purport to be many devices and appear legitimate and inject
 seemingly valid data into the network. Is there a reference?</rcc>

 * Section 5.4.1.   Routing Exchange Interference or Disruption

    The forms of attack that allow interference or disruption of routing
 exchange include:

    o  Routing information replay;

 <rcc>This has already been mentioned in the context of node impersonation
 (which IMHO is where it should live) - maybe state this could be sustained
 routing information replay? Or is this simply an overload attack?</rcc>

 * Section 5.4.2 Network Traffic Forwarding Disruption

 <rcc>What's the difference between a "sinkhole" attack and a "blackhole"
 attack (mentioned earlier)? Also, isn't "sinkhole" better known as
 "honeypot"?</rcc>

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-roll-
  [email-masked]          |  [email-masked]
     Type:  defect                   |     Status:  new
 Priority:  major                    |  Milestone:
Component:  security-threats         |    Version:
 Severity:  In WG Last Call          |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/roll/trac/ticket/152>
roll <http://tools.ietf.org/wg/roll/>

---

From: "roll issue tracker" <[email-masked]>
Date: Tue, 25 Feb 2014 13:51:15 -0000

Changes (by [email-masked]):

 * owner:  [email-masked] =>
            [email-masked]
 * status:  new => assigned

-- 
---------------------------------------+-------------------------------
 Reporter:  [email-masked]  |       Owner:  [email-masked]
     Type:  defect                     |      Status:  assigned
 Priority:  major                      |   Milestone:
Component:  security-threats           |     Version:
 Severity:  In WG Last Call            |  Resolution:
 Keywords:                             |
---------------------------------------+-------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/roll/trac/ticket/152#comment:1>
roll <http://tools.ietf.org/wg/roll/>