Subject: [Smart] SMART Problems

From: Kirsty P <[email-masked]>
Date: Mon, 1 Oct 2018 13:22:14 +0000

Hi SMART folks,

I promised an initial problems list that the group could be working on, so here it is! Please comment and/or add your own research ideas/existing projects those we've sketched out below...

Kirsty

  *   Assessment methodology: Systematic analysis of attack defence impacts requires an evidence-based methodology. Research will start with a survey of existing attacks and existing detection methods. The information used by each detection method from Internet protocols and other sources (such as endpoints) shall be identified. Further research will determine the relative effectiveness of each detection method against each attack. In doing so, this research will define methodologies for detection, as known attacks change and detection methods develop. These methodologies can be used to provide the basis of evidence for assessment of protocol impact.
  *   Certificate Transparency: Certificate transparency can be used to spot mis-issued certificates for domains. But do certificate transparency logs highlight malicious domains? More research is needed to determine the effectiveness of this technology in finding malicious sites.
  *   DMARC: Implementation of DMARC across government correlates with the numbers of phishing emails claiming to be from these domains dropping dramatically. Research is needed to ascertain the exact effects of implementing this protocol and to discover what impact, if any, this has had on the behaviour of the actors behind such phishing emails.
  *   DNS: As protocols to encrypt DNS traffic are implemented and newly-proposed designs surface, existing techniques for restricting DNS lookups to blacklisted domains may be impacted and could increase the risk from malware to a network. The IRTF can bring together network operators and protocol experts to research and discover new ways to provide this security as DNS traffic becomes encrypted.
  *   IPv6: Adoption of IPv6 is now widespread, with statistics from 2017 indicating that 23% of networks advertise IPv6 connectivity. Evidence-based research is needed to establish what benefits or risks come from IPv6 adoption in terms of attack defence, and to find recommendations to optimise defence protections.
  *   TLS: With a new version of TLS recently standardised, existing attack defence methods need to adapt as implementations begin to adopt it. This area of research needs to grow quickly, with key questions such as: “Can malware be detected when it uses TLS 1.3? If so, how?” The IRTF is the ideal place to stimulate this thread of work, to bring together members with protocol expertise and members with defence experience.
  *   UDP: Some firewalls and middleboxes simply block UDP, in their efforts to protect networks from malicious traffic – so much so that this issue was considered in the design of QUIC. When QUIC is standardised, UDP traffic will only grow in volume, and it will be more important than ever to research techniques for detecting malicious activity in encrypted UDP streams, enabling a better malware defence than simply blocking UDP traffic in future.

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: "John Levine" <[email-masked]>
Date: 4 Oct 2018 12:59:15 -0400

In article <[email-masked]> you write:
>I promised an initial problems list that the group could be working on, so here it is! Please
>comment and/or add your own research ideas/existing projects those we've sketched out below...

This is a dandy set of questions, but do you have any actual
researchers willing to do this?

I know a fair number who as far as I know are happy with the venues
they already have.

R's,
John

---

From: Kirsty P <[email-masked]>
Date: Thu, 11 Oct 2018 08:56:58 +0000

John,

That's a fair question and one I've asked myself before starting this group! We've had some conversations with academics who have indicated they would like to be engaged with SMART, and who have relevant and interesting research to bring to the table. We've also seen interest from industry, who are keen to support and see the value in such a group in the IRTF and the problems we describe. And of course, any contacts you have are very welcome to join in the group too - the more, the merrier!

In the meantime, I'm glad to hear that you find the set of questions "dandy" - and I welcome your ideas for research topics to make it even dandier...

Kirsty

________________________________
From: John Levine <[email-masked]>
Sent: 04 October 2018 17:59
To: [email-masked]
Cc: Kirsty P
Subject: Re: [Smart] SMART Problems

R's,
John

---

From: Kirsty P <[email-masked]>
Date: Thu, 11 Oct 2018 08:58:42 +0000

Hi everyone,

We've heard from a few people on these initial ideas, but more discussion is welcome - are there any problems we're missing and should be focusing on?

Kirsty

________________________________
From: Kirsty P
Sent: 01 October 2018 14:22
To: [email-masked]
Subject: SMART Problems

Hi SMART folks,

Kirsty

---

From: Bret Jordan <[email-masked]>
Date: Thu, 11 Oct 2018 08:47:03 -0600

Kristy,

I think we can get academia and industry to help and contribute to this work.  The problem is purely PR/Marketing.  We need to raise awareness of this and help make sure the right groups and researchers know about it.

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Oct 11, 2018, at 2:56 AM, Kirsty P <Kirsty.p=[email-masked]> wrote:
> 
> John,
> 
> From: John Levine <[email-masked] <mailto:[email-masked]>>
> To: [email-masked] <mailto:[email-masked]>
> Cc: Kirsty P
> In article <[email-masked] <mailto:[email-masked]>> you write:
> This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked] <mailto:[email-masked]> -- 
> Smart mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.irtf.org/mailman/listinfo/smart <https://www.irtf.org/mailman/listinfo/smart>

---

From: Bret Jordan <[email-masked]>
Date: Thu, 11 Oct 2018 09:00:10 -0600

Kristy,

Zero Trust, Borderless Networks, Firewall-less networks (Google’s BeyondCorp), LTE5, Direct-to-net / Direct-to-Telco, Employee owned devices, SDN, TLS1.3, DOH + DNSSEC, QUIC, Cloud Services, MicroServices, etc are going to collectively wreck havoc with traditional network defense. By themselves they are all manageable and great additions to the performance, management, security, and privacy of the network, however, when you start connecting all of these technologies together as a single solution, it is going to pose some serious challenges.

In a past life we had a saying that  “endpoints, operating systems, and software can all be made to lie, but the network never does. At some point the traffic has to flow over the network”.  So making sure we understand the risks associated with assuming that all security can be done on the endpoint, would be good. 

Understanding the risks of overlay protocols. What happens if organizations, ISPs, Telcos, start wrapping some of our secure protocols with less secure protocols to make them work across their networks. 

Thanks,
Bret

> On Oct 11, 2018, at 2:58 AM, Kirsty P <Kirsty.p=[email-masked]> wrote:
> 
> Hi everyone,
> 
> Assessment methodology: Systematic analysis of attack defence impacts requires an evidence-based methodology. Research will start with a survey of existing attacks and existing detection methods. The information used by each detection method from Internet protocols and other sources (such as endpoints) shall be identified. Further research will determine the relative effectiveness of each detection method against each attack. In doing so, this research will define methodologies for detection, as known attacks change and detection methods develop. These methodologies can be used to provide the basis of evidence for assessment of protocol impact.
> Certificate Transparency: Certificate transparency can be used to spot mis-issued certificates for domains. But do certificate transparency logs highlight malicious domains? More research is needed to determine the effectiveness of this technology in finding malicious sites.
> DMARC: Implementation of DMARC across government correlates with the numbers of phishing emails claiming to be from these domains dropping dramatically. Research is needed to ascertain the exact effects of implementing this protocol and to discover what impact, if any, this has had on the behaviour of the actors behind such phishing emails.
> DNS: As protocols to encrypt DNS traffic are implemented and newly-proposed designs surface, existing techniques for restricting DNS lookups to blacklisted domains may be impacted and could increase the risk from malware to a network. The IRTF can bring together network operators and protocol experts to research and discover new ways to provide this security as DNS traffic becomes encrypted.
> IPv6: Adoption of IPv6 is now widespread, with statistics from 2017 indicating that 23% of networks advertise IPv6 connectivity. Evidence-based research is needed to establish what benefits or risks come from IPv6 adoption in terms of attack defence, and to find recommendations to optimise defence protections.
> TLS: With a new version of TLS recently standardised, existing attack defence methods need to adapt as implementations begin to adopt it. This area of research needs to grow quickly, with key questions such as: “Can malware be detected when it uses TLS 1.3? If so, how?” The IRTF is the ideal place to stimulate this thread of work, to bring together members with protocol expertise and members with defence experience.
> UDP: Some firewalls and middleboxes simply block UDP, in their efforts to protect networks from malicious traffic – so much so that this issue was considered in the design of QUIC. When QUIC is standardised, UDP traffic will only grow in volume, and it will be more important than ever to research techniques for detecting malicious activity in encrypted UDP streams, enabling a better malware defence than simply blocking UDP traffic in future.
> 
> 
>