Subject: Router backdoor threat model

From: "Songhaibin (A)" <[email-masked]>
Date: Thu, 30 Oct 2014 03:40:59 +0000

Hi,

We have submitted a draft on router backdoor threat model. The main target is the threat model at the beginning. It is a little limited to the device level instead of the routing system level. Some threats are common to other devices as well. We would like to know if there are people interested in this work or can give some constructive comments or input. Any related discussion in the list or with the authors is welcome : )

Here is the link for the draft.
http://www.ietf.org/id/draft-song-router-backdoor-00.txt

Best Regards!
-Haibin

---

From: Uma Chunduri <[email-masked]>
Date: Thu, 30 Oct 2014 18:35:01 +0000

If this is real, this is kind of byzantine attack and can be far more damaging than what's being listed in this document.
Routing protocols security/Threat models generally discount this. 

Is there any proof of detection of this kind of backdoors in operator networks?
--
Uma C.

-----Original Message-----
From: rtgwg [mailto:[email-masked]] On Behalf Of Songhaibin (A)
Sent: Wednesday, October 29, 2014 8:41 PM
To: [email-masked]
Subject: Router backdoor threat model

Hi,

Best Regards!
-Haibin

_______________________________________________
rtgwg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/rtgwg

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 30 Oct 2014 22:19:15 +0100 (CET)

> Is there any proof of detection of this kind of backdoors in operator networks?

http://www.infoworld.com/article/2608141/internet-privacy/snowden--the-nsa-planted-backdoors-in-cisco-products.html

This is a security question, I'm not sure the IETF is the best place to 
document these issues, even though it affects products that are used to 
implement IETF protocols. There is no doubt in my mind that there is a 
problem with all kinds of products being potentially backdoored, I have 
read enough papers on BIOS on motherboards, NICs etc being backdoored and 
end up running malicious software that is virtually impossible to detect 
and eradicate by an operator.

I don't know what to make of the document though, I think it depends on 
what its intended audience is. If it's supposed to make people aware of 
the potential problem, then it needs more facts and references to assure 
people that the problems described are real (because some will say it's 
not real until it's actually happened).

Another one where telecom functionality designed and implemented by 
government request was used in another fashion is 
<http://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%9305>. 
Here the LI function (which some government require to be invisible to the 
normal operator) was used to spy on some phones. You can probably get more 
detailed information internally from your colleagues about that one, 
compared to what is publically available.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Antoni Przygienda <[email-masked]>
Date: Thu, 30 Oct 2014 21:45:43 +0000

That's actually a draft documenting the only real feature Huwaei implemented in their product line after they assimilated in accelerated fashion some routing code they found by chance 10+ years ago :-P

Issue is well-known since couple years. 

-- tony

> From: rtgwg [mailto:[email-masked]] On Behalf Of Uma Chunduri
> Sent: Thursday, October 30, 2014 11:35 AM
> To: Songhaibin (A); [email-masked]
> Subject: RE: Router backdoor threat model
> 
> If this is real, this is kind of byzantine attack and can be far more damaging
> than what's being listed in this document.
> We have submitted a draft on router backdoor threat model. The main
> target is the threat model at the beginning. It is a little limited to the device
> level instead of the routing system level. Some threats are common to other
> devices as well. We would like to know if there are people interested in this
> work or can give some constructive comments or input. Any related
> discussion in the list or with the authors is welcome : )
>

---

From: Antoni Przygienda <[email-masked]>
Date: Thu, 30 Oct 2014 21:59:02 +0000

ouch, that was obviously intended as a joke and escaped the intended distribution list.  

thoroughly sorry for that guys, should have known after all those years that  reply-all: is a bug and not a mailer feature

--- tony 

> From: rtgwg [mailto:[email-masked]] On Behalf Of Antoni
> Przygienda
> Sent: Thursday, October 30, 2014 2:46 PM
> To: Uma Chunduri; Songhaibin (A); [email-masked]
> That's actually a draft documenting the only real feature Huwaei
> implemented in their product line after they assimilated in accelerated
> fashion some routing code they found by chance 10+ years ago :-P
>

---

From: Vitkovský Adam <[email-masked]>
Date: Thu, 30 Oct 2014 22:01:39 +0000

Hi folks,

At least Cisco went public with the whole lawful-intercept thing though the actual functionality is not explained: 
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/lawful/intercept/book/65LIch1.html
http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-1/security/configuration/guide/b_syssec_cg41asr9k/b_syssec_cg41asr9k_chapter_011.html

It's a good think we can disable the functionality with "lawful-intercept disable", but oh wait we can't no more on the recent XR version. 
Since the lawful-intercept disable is now hidden/unavailable may I assume the necessary SNMP configs to public government IPs are hidden as well? 

adam
> Sent: Thursday, October 30, 2014 4:41 AM
> To: [email-masked]
> We have submitted a draft on router backdoor threat model. The main target is
> the threat model at the beginning. It is a little limited to the device level
> instead of the routing system level. Some threats are common to other devices
> as well. We would like to know if there are people interested in this work or
> can give some constructive comments or input. Any related discussion in the list
> or with the authors is welcome : )
>

---

From: "Songhaibin (A)" <[email-masked]>
Date: Fri, 31 Oct 2014 04:07:03 +0000

This is a ridiculous joke which is not funny at all.

Best Regards!
-Haibin

> From: Antoni Przygienda [mailto:[email-masked]]
> Sent: Friday, October 31, 2014 5:59 AM
> To: Antoni Przygienda; Uma Chunduri; Songhaibin (A); [email-masked]
> thoroughly sorry for that guys, should have known after all those years that
> reply-all: is a bug and not a mailer feature
> 
> --- tony
> 
> > implemented in their product line after they assimilated in
> > accelerated fashion some routing code they found by chance 10+ years
> > ago :-P
> >

---

From: "Songhaibin (A)" <[email-masked]>
Date: Fri, 31 Oct 2014 04:58:39 +0000

Hi Adam,

I think technical specifications cannot go beyond laws. Since IMO lawful interception is required by laws in most countries in the world, we cannot protect communication from LI. I guess what we should avoid is the man in the middle attack.

Best Regards!
-Haibin

> From: Vitkovský Adam [mailto:[email-masked]]
> Sent: Friday, October 31, 2014 6:02 AM
> http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-1/
> security/configuration/guide/b_syssec_cg41asr9k/b_syssec_cg41asr9k_chapte
> r_011.html
> 
> It's a good think we can disable the functionality with "lawful-intercept disable",
> but oh wait we can't no more on the recent XR version.
> Since the lawful-intercept disable is now hidden/unavailable may I assume the
> necessary SNMP configs to public government IPs are hidden as well?
> 
> 
> adam
> > target is the threat model at the beginning. It is a little limited to
> > the device level instead of the routing system level. Some threats are
> > common to other devices as well. We would like to know if there are
> > people interested in this work or can give some constructive comments
> > or input. Any related discussion in the list or with the authors is
> > welcome : )
> >

---

From: "Fred Baker (fred)" <[email-masked]>
Date: Fri, 31 Oct 2014 05:01:48 +0000

> I think technical specifications cannot go beyond laws. Since IMO lawful interception is required by laws in most countries in the world, we cannot protect communication from LI. I guess what we sh…

Pretty much.

---

From: "Songhaibin (A)" <[email-masked]>
Date: Fri, 31 Oct 2014 05:17:46 +0000

Hi Mikael,

The motivation is that router vendors (with global market) are more or less doubted with security concerns when doing international business. If we can give a clear potential threat model on how it works when committing a malicious eavesdropping or something else, and a guidance on how to avoid the problem or protect the communication, then it will help to mitigate those security concerns (I do not say fully, but more or less).

I do not see the facts of router backdoors, even in the event of PRISM, the backdoor is not from the vendor either. 

Best Regards!
-Haibin

> From: rtgwg [mailto:[email-masked]] On Behalf Of Mikael
> Abrahamsson
> Sent: Friday, October 31, 2014 5:19 AM
> To: Uma Chunduri
> Cc: [email-masked]
> http://www.infoworld.com/article/2608141/internet-privacy/snowden--the-nsa
> -planted-backdoors-in-cisco-products.html
> 
> This is a security question, I'm not sure the IETF is the best place to document
> these issues, even though it affects products that are used to implement IETF
> protocols. There is no doubt in my mind that there is a problem with all kinds of
> products being potentially backdoored, I have read enough papers on BIOS on
> motherboards, NICs etc being backdoored and end up running malicious
> software that is virtually impossible to detect and eradicate by an operator.
> 
> I don't know what to make of the document though, I think it depends on what
> its intended audience is. If it's supposed to make people aware of the potential
> problem, then it needs more facts and references to assure people that the
> problems described are real (because some will say it's not real until it's
> actually happened).
> 
> detailed information internally from your colleagues about that one, compared
> to what is publically available.
> 
> --

---

From: "Songhaibin (A)" <[email-masked]>
Date: Fri, 31 Oct 2014 05:23:04 +0000

There was TCP 32764 backdoor reported on home routers. But telecom routers are actually much more secure and I do not see any backdoor report.

Best Regards!
-Haibin

---

From: Antoni Przygienda <[email-masked]>
Date: Fri, 31 Oct 2014 06:17:04 +0000

I would like to express with this email again a sincere apology to the 
authors of the draft and any company or individual whose feelings may 
have been hurt by the slip in the email communication from my side 
today. I hope that the author who offered to accept this apology 
is magnanimous enough to do so.

thanks 

--- tony 

> From: Songhaibin (A) [mailto:[email-masked]]
> Sent: Thursday, October 30, 2014 9:07 PM
> To: Antoni Przygienda; Uma Chunduri; [email-masked]

---

From: "Songhaibin (A)" <[email-masked]>
Date: Fri, 31 Oct 2014 06:24:35 +0000

Tony,

Accepted.

-Haibin

> Sent: Friday, October 31, 2014 2:17 PM
> I would like to express with this email again a sincere apology to the authors of
> the draft and any company or individual whose feelings may have been hurt by
> the slip in the email communication from my side today. I hope that the author
> who offered to accept this apology is magnanimous enough to do so.
> 
> thanks
> 
> --- tony
>

---

From: Stewart Bryant <[email-masked]>
Date: Fri, 31 Oct 2014 18:03:16 +0000

For much of this you could cross out router and write in host.

It all applies to many networking functions other that routers such as 
switches, firewalls, NFV functions etc.

I am not convinced that RTGWG is the right place for this, a good case 
could be made for OPSWG or somewhere in SEC.

Stewart

-- 
For corporate legal information go to:

http://www.cisco.com/web/about/doing_business/legal/cri/index.html