First login?
Lost password?
 
 
sctp-discussion AT lists.franken.de 
SCTP Discussions

Text archives Help


[SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?


Chronological Thread 
  • From: Randall Stewart <randall AT stewart.chicago.il.us>
  • To: Andreas Jungmaier <ajung AT exp-math.uni-essen.de>
  • Cc: john.loughney AT nokia.com, discussion AT sctp.de, Hollaus Thomas <thomas.hollaus AT siemens.at>, tsvwg AT ietf.org
  • Subject: [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?
  • Date: Thu Feb 14 18:33:07 2002
  • List-id: SCTP Discussions <discussion.sctp.de>
Andreas Jungmaier wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Randy,
>
> please see my comments inline.
>
> On Thursday, 14. February 2002 15:40, Randall Stewart wrote:
> > Andreas:
> >
> > There is no amplification here though... so it is no
> > different than if Evil-E sent the aborts itself
> > to all the "victims" V... it must send N packets
> > to get N packets to victims... this is no
> > different than a UDP attack.. in fact a UDP attack
> > is easier...
>
> Well, *almost*. The only problem I see here is that many
> network installations by now have already adapted to UDP
> attacks, e.g. by filtering excessive amounts (or simply all)
> ICMP dest. unreachble packets (which are subsequently
> jamming the targets/victims network).
>
> With SCTP, however, it is not that simple: you get back
> a transport layer packet that is much harder to filter.

How is SCTP harder to filter than UDP.. UDP IS a transport
protocol and the ports in the UDP/TCP header are in the
same place as the SCTP header...


> Think about it: there have been MANY distributed DoS attacks
> based on UDP, why shouldn't there be some based on SCTP some
> day ?

Or TCP.. at this level though your attacker is limited
to the bandwidth/cpu of the Evil-E machine. This is NO
different than TCP or UDP or anything else out there
now...

I fail to see how it is an issue..

R


>
> BTW, John: I am not concerned about cycles for processing
> ABORTs. The problem really arises when an attacker starts a lot
> of "Evil Endpoints E", that all have one target: Victim V.
> The scarce resource is bandwidth.
>
> > Andreas Jungmaier wrote:
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > >
> > > Dear all,
> > >
> > > I am sorry for not explaining more exactly what I meant.
> > > I am assuming an attack with IP-Spoofing. The evil attacker
> > > (say E) is spoofing poor victim (say V), using oblivious
> > > server (say) O.
> > >
> > > Now,
> > >
> > > Evil-Endpoint E:
> > > Source IP V(spoofed)
> > > Dest IP O
> > > SCTP-INIT (invalid params) ----------------> Server O
> > > /-------------/
> > > SCTP-Abort,Error /
> > > Poor Victim V <--------------/
> > >
> > > Now, if E can use V, it could send such packets to a large number
> > > of servers. And then V gets bombed with Aborts.
> > >
> > > I agree fully, that an established association is safe, but that
> > > was not the issue I was thinking about. Comments ?
> > >
>
> - --
> - ------------------------------------------------------------------------
> Dipl.-Ing. Andreas Jungmaier | _
> Computer Networking Technology Group | ASCII ribbon campaign ( )
> University of Essen | - against HTML email X
> http://www.exp-math.uni-essen.de/~ajung | & vcards / \
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
>
> iD8DBQE8a+eMXAsLBNOCSsARAmPfAJ47qG/Zy9+7omHnCOkbhsNR1b73QwCfZSQz
> vIKQ3YdsJjzX46WI8XX/Qbk=
> =g5mQ
> -----END PGP SIGNATURE-----

--
Randall R. Stewart
randall AT stewart.chicago.il.us
815-342-5222 (cell phone)


Archive powered by MHonArc 2.6.19+.

Top of page