Subject: Re: [alto] Hannes security questions

From: Wendy Roome <[email-masked]>
Date: Fri, 15 Mar 2013 10:09:56 -0400

Seems to me that if the "bad guys" can subvert DHCP and DNS servers,
they've already taken over the network. Why would they bother spoofing an
ALTO server? And if they have "admin access to network equipment," the
odds are they're already running the ALTO server.

Did I miss something here?  Yes, those are real threats, but they have
nothing to do with ALTO security.

	- Wendy

>
>From: Sebastian Kiesel <[email-masked]>
>Subject: Re: [alto] Hannes security questions
>>>
>>>Just as an example: Why would someone want to sent a client fake ALTO
>>>information or impersonate a server? What would be their benefit?
>>One reason for spoofing an ALTO server would be to divert clients from
>>legitimate servers to the spoofer's fake server. But I don't see any way
>>a
>>spoofer can do that with the ALTO protocol.
>
>Depending on the network scenario and depending on whether the attacker
>is a "regular user" or has administrative access to the access network
>equipment, one could try sending forged DHCP replies in an Ethernet, try
>some DNS poisoning, install a transparent HTTP proxy that does some
>modifications, etc.
>

---

From: "Y. Richard Yang" <[email-masked]>
Date: Fri, 15 Mar 2013 16:22:48 -0400

Wendy,

You are slightly more pessimistic here. Even after the "bad guy" takes over
DHCP, DNS, ..., it may or may not already take control of the ALTO server,
obtained private key to the server certificate, ... Our job is to do our
share to provide the authenticity,  integrity, and confidentiality, as much
as we can. I saw your point that you might want us to use more "benign"
compromised settings, which we sure can tweak the wording a bit. How does
this sound?

Thanks,

Richard

---

From: Hannes Tschofenig <[email-masked]>
Date: Sat, 16 Mar 2013 08:14:35 -0400

The issue is not so much that an attacker can take over a DHCP or a DNS server. Then, you are indeed in trouble. 

The problem is more that DHCP and DNS traffic is not integrity protected (and in case of DHCP it is even hard to do it).
Someone located in your local network could inject or modify traffic.

Whether you consider this is a threat you care about is a secondary consideration. 

On Mar 15, 2013, at 10:09 AM, Wendy Roome wrote:

> _______________________________________________
> alto mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/alto

---

From: Sebastian Kiesel <[email-masked]>
Date: Sun, 17 Mar 2013 22:35:16 +0100

On Fri, Mar 15, 2013 at 10:09:56AM -0400, Wendy Roome wrote:
> ALTO server?

for the P2P use case you are probably right - if you control DNS you can
probably do much cooler things than pessimize P2P traffic patterns.

on the other hand, you could subert DNS, change as little as possible
hoping it remains undetected, but spoof the ALTO server in order to turn
a large P2P network in a DDoS infrastructure. OK, maybe this is a bit
silly ...

... on the other hand we should really care about security in our base
protocol. There is more than just the P2P use case, look at the various
proposed extensions and think of use cases that didn't even come to
our minds yet. Furhermore it is in general a good practice to have
several lines of defense. Attacks against DNS and DHCP get less
interesting if every applications (including the presumably "boring"
ones) can detect spoofing. Adding this detection mechanisms may be
easier than making DNS and DHCP secure in the first place.

Thanks
Sebastian