Chronological Thread 

< Chronological >      < Thread >

---

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Randy,

please see my comments inline.

On Thursday, 14. February 2002 15:40, Randall Stewart wrote:
> Andreas:
>
> There is no amplification here though... so it is no
> different than if Evil-E sent the aborts itself
> to all the "victims" V... it must send N packets
> to get N packets to victims... this is no
> different than a UDP attack.. in fact a UDP attack
> is easier...

Well, *almost*. The only problem I see here is that many
network installations by now have already adapted to UDP
attacks, e.g. by filtering excessive amounts (or simply all)
ICMP dest. unreachble packets (which are subsequently
jamming the targets/victims network).

With SCTP, however, it is not that simple: you get back
a transport layer packet that is much harder to filter.
Think about it: there have been MANY distributed DoS attacks
based on UDP, why shouldn't there be some based on SCTP some
day ?

BTW, John: I am not concerned about cycles for processing
ABORTs. The problem really arises when an attacker starts a lot
of "Evil Endpoints E", that all have one target: Victim V.
The scarce resource is bandwidth.


> Andreas Jungmaier wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Dear all,
> >
> > I am sorry for not explaining more exactly what I meant.
> > I am assuming an attack with IP-Spoofing. The evil attacker
> > (say E) is spoofing poor victim (say V), using oblivious
> > server (say) O.
> >
> > Now,
> >
> > Evil-Endpoint E:
> > Source IP V(spoofed)
> > Dest IP O
> > SCTP-INIT (invalid params) ----------------> Server O
> > /-------------/
> > SCTP-Abort,Error /
> > Poor Victim V <--------------/
> >
> > Now, if E can use V, it could send such packets to a large number
> > of servers. And then V gets bombed with Aborts.
> >
> > I agree fully, that an established association is safe, but that
> > was not the issue I was thinking about. Comments ?
> >

- --
- ------------------------------------------------------------------------
Dipl.-Ing. Andreas Jungmaier | _
Computer Networking Technology Group | ASCII ribbon campaign ( )
University of Essen | - against HTML email X
http://www.exp-math.uni-essen.de/~ajung | & vcards / \
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8a+eMXAsLBNOCSsARAmPfAJ47qG/Zy9+7omHnCOkbhsNR1b73QwCfZSQz
vIKQ3YdsJjzX46WI8XX/Qbk=
=g5mQ
-----END PGP SIGNATURE-----

---

• [SCTP-Discussion] receive of unexpected chunks with invalid parameters, Hollaus Thomas, 02/14/2002
  • Possible DoS in SCTP ? (was: [SCTP-Discussion] receive of unexpected chunks with invalid parameters), Andreas Jungmaier, 02/14/2002
    • Re: [Tsvwg] Possible DoS in SCTP ? (was: [SCTP-Discussion] receive of unexpected chunks with invalid parameters), Randall Stewart, 02/14/2002
      • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ? (was: reception of invalid parameters), Andreas Jungmaier, 02/14/2002
        • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ? (was: reception of invalid parameters), Randall Stewart, 02/14/2002
          • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?, Andreas Jungmaier, 02/14/2002
            • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?, Randall Stewart, 02/14/2002
              • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?, Andreas Jungmaier, 02/14/2002

---

Archive powered by MHonArc 2.6.19+.