to cause denial-of-service to the target node or network? The target
does not typically play much of an active role attack. As an
example, an attacker may launch a denial-of-service attack on a given
node, A, by contacting a large number of nodes, claiming to be A, and
subsequently diverting the traffic at these other nodes so that A is
no longer able to receive packets from those nodes. A itself need
not be involved at all before its communications start to break.
Furthermore, A is not necessarily a mobile node; it may well be
stationary.
Mobile IPv6 uses the same class of IP addresses for both mobile nodes
(i.e., home and care-of addresses) and stationary nodes. That is,
mobile and stationary addresses are indistinguishable from each
other. Attackers can take advantage of this by taking any IP address
and using it in a context where, normally, only mobile (home or
care-of) addresses appear. This means that attacks that otherwise
would only concern mobile nodes are, in fact, a threat to all IPv6
nodes.
In fact, a mobile node appears to be best protected, since a mobile
node does not need to maintain state about the whereabouts of some
remote nodes. Conversely, the role of being a correspondent node
appears to be the weakest, since there are very few assumptions upon
which it can base its state formation. That is, an attacker has a
much easier task in fooling a correspondent node to believe that a
presumably mobile node is somewhere it is not, than in fooling a
mobile node itself into believing something similar. On the other
hand, since it is possible to attack a node indirectly by first
targeting its peers, all nodes are equally vulnerable in some sense.
Furthermore, a (usually) mobile node often also plays the role of
being a correspondent node, since it can exchange packets with other
mobile nodes (see also Section 5.4).
2.2. Timing
An important aspect in understanding Mobile IPv6-related dangers is
timing. In a stationary IPv4 network, an attacker must be between
the communication nodes at the same time as the nodes communicate.
With the Mobile IPv6 ability of creating binding cache entries, the
situation changes. A new danger is created. Without proper
protection, an attacker could attach itself between the home agent
and a correspondent node for a while, create a BCE at the
correspondent node, leave the position, and continuously update the
correspondent node about the mobile node’s whereabouts. This would
make the correspondent node send packets destined to the mobile node
to an incorrect address as long as the BCE remained valid, i.e.,
typically until the correspondent node is rebooted. The converse
would also be possible: an attacker could also launch an attack by
first creating a BCE and then letting it expire at a carefully
selected time. If a large number of active BCEs carrying large
amounts of traffic expired at the same time, the result might be an
overload towards the home agent or the home network. (See Section
3.2.2 for a more detailed explanation.)
2.3. Location
In a static IPv4 Internet, an attacker can only receive packets
destined to a given address if it is able to attach itself to, or to
control, a node on the topological path between the sender and the
recipient. On the other hand, an attacker can easily send spoofed
packets from almost anywhere. If Mobile IPv6 allowed sending
unprotected Binding Updates, an attacker could create a BCE on any
correspondent node from anywhere in the Internet, simply by sending a
fraudulent Binding Update to the correspondent node. Instead of
being required to be between the two target nodes, the attacker could
act from anywhere in the Internet.
In summary, by introducing the new routing exception (binding cache)
at the correspondent nodes, Mobile IPv6 introduces the dangers of
time and space shifting. Without proper protection, Mobile IPv6
would allow an attacker to act from anywhere in the Internet and well
before the time of the actual attack. In contrast, in the static
IPv4 Internet, the attacking nodes must be present at the time of the
attack and they must be positioned in a suitable way, or the attack
would not be possible in the first place.
3. Threats and Limitations
This section describes attacks against Mobile IPv6 Route Optimization
and what protection mechanisms Mobile IPv6 applies against them. The
goal of the attacker can be to corrupt the correspondent node’s
binding cache and to cause packets to be delivered to a wrong
address. This can compromise secrecy and integrity of communication
and cause denial-of-service (DoS) both at the communicating parties
and at the address that receives the unwanted packets. The attacker
may also exploit features of the Binding Update (BU) mechanism to
exhaust the resources of the mobile node, the home agent, or the
correspondent nodes. The aim of this section is to provide an
overview of the various protocol mechanisms and their limitations.
The details of the mechanisms are covered in Section 4.
It is essential to understand that some of the threats are more
serious than others, that some can be mitigated but not removed, that
some threats may represent acceptable risk, and that some threats may
be considered too expensive to the attacker to be worth preventing.
We consider only active attackers. The rationale behind this is that
in order to corrupt the binding cache, the attacker must sooner or
later send one or more messages. Thus, it makes little sense to
consider attackers that only observe messages but do not send any.
In fact, some active attacks are easier, for the average attacker, to
launch than a passive one would be. That is, in many active attacks
the attacker can initiate binding update processing at any time,
while most passive attacks require the attacker to wait for suitable
messages to be sent by the target nodes.
Nevertheless, an important class of passive attacks remains: attacks
on privacy. It is well known that simply by examining packets,
eavesdroppers can track the movements of individual nodes (and
potentially, users) [3]. Mobile IPv6 exacerbates the problem by
adding more potentially sensitive information into the packets (e.g.,
Binding Updates, routing headers or home address options). This
document does not address these attacks.
We first consider attacks against nodes that are supposed to have a
specified address (Section 3.1), continuing with flooding attacks
(Section 3.2) and attacks against the basic Binding Update protocol
(Section 3.3). After that, we present a classification of the
attacks (Section 3.4). Finally, we consider the applicability of
solutions relying on some kind of a global security infrastructure
(Section 3.5).
3.1. Attacks Against Address ’Owners’ ("Address Stealing")
The most obvious danger in Mobile IPv6 is address "stealing", when an
attacker illegitimately claims to be a given node at a given address
and tries to "steal" traffic destined to that address. We first
describe the basic variant of this attack, follow with a description
of how the situation is affected if the target is a stationary node,
and continue with more complicated issues related to timing (so
called "future" attacks), confidentiality and integrity, and DoS
aspects.
3.1.1. Basic Address Stealing
If Binding Updates were not authenticated at all, an attacker could
fabricate and send spoofed binding updates from anywhere in the
Internet. All nodes that support the correspondent node
functionality would become unwitting accomplices to this attack. As
explained in Section 2.1, there is no way of telling which addresses
belong to mobile nodes that really could send binding updates and
which addresses belong to stationary nodes (see below), so
potentially any node (including "static" nodes) is vulnerable.
+---+ original +---+ new packet +---+
| B |<----------------| A |- - - - - - ->| C |
+---+ packet flow +---+ flow +---+
^
|
| False BU: B -> C
|
+----------+
| Attacker |
+----------+
Figure 2. Basic Address Stealing
Consider an IP node, A, sending IP packets to another IP node, B.
The attacker could redirect the packets to an arbitrary address, C,
by sending a Binding Update to A. The home address (HoA) in the
binding update would be B and the care-of address (CoA) would be C.
After receiving this binding update, A would send all packets
intended for the node B to the address C. See Figure 2.
The attacker might select the care-of address to be either its own
current address, another address in its local network, or any other
IP address. If the attacker selected a local care-of address
allowing it to receive the packets, it would be able to send replies
to the correspondent node. Ingress filtering at the attacker’s
local+ network does not prevent the spoofing of Binding Updates but
forces the attacker either to choose a care-of address from inside
its own network or to use the Alternate care-of address sub-option.
The binding update authorization mechanism used in the MIPv6 security
design is primarily intended to mitigate this threat, and to limit
the location of attackers to the path between a correspondent node
and the home agent.
3.1.2. Stealing Addresses of Stationary Nodes
The attacker needs to know or guess the IP addresses of both the
source of the packets to be diverted (A in the example above) and the
destination of the packets (B, above). This means that it is
difficult to redirect all packets to or from a specific node because
the attacker would need to know the IP addresses of all the nodes
with which it is communicating.
Nodes with well-known addresses, such as servers and those using
stateful configuration, are most vulnerable. Nodes that are a part
of the network infrastructure, such as DNS servers, are particularly
interesting targets for attackers and particularly easy to identify.
Nodes that frequently change their address and use random addresses
are relatively safe. However, if they register their address into
Dynamic DNS, they become more exposed. Similarly, nodes that visit
publicly accessible networks such as airport wireless LANs risk
revealing their addresses. IPv6 addressing privacy features [3]
mitigate these risks to an extent, but note that addresses cannot be
completely recycled while there are still open sessions that use
those addresses.
Thus, it is not the mobile nodes that are most vulnerable to address
stealing attacks; it is the well-known static servers. Furthermore,
the servers often run old or heavily optimized operating systems and
may not have any mobility related code at all. Thus, the security
design cannot be based on the idea that mobile nodes might somehow be
able to detect whether someone has stolen their address, and reset
the state at the correspondent node. Instead, the security design
must make reasonable measures to prevent the creation of fraudulent
binding cache entries in the first place.
3.1.3. Future Address Sealing
If an attacker knows an address that a node is likely to select in
the future, it can launch a "future" address stealing attack. The
attacker creates a Binding Cache Entry with the home address that it
anticipates the target node will use. If the Home Agent allows
dynamic home addresses, the attacker may be able to do this
legitimately. That is, if the attacker is a client of the Home Agent
and is able to acquire the home address temporarily, it may be able
to do so and then to return the home address to the Home Agent once
the BCE is in place.
Now, if the BCE state had a long expiration time, the target node
would acquire the same home address while the BCE is still effective,
and the attacker would be able to launch a successful man-in-the-
middle or denial-of-service attack. The mechanism applied in the
MIPv6 security design is to limit the lifetime of Binding Cache
Entries to a few minutes.
Note that this attack applies only to fairly specific conditions.
There are also some variations of this attack that are theoretically
possible under some other conditions. However, all of these attacks
are limited by the Binding Cache Entry lifetime, and therefore they
are not a real concern with the current design.
3.1.4. Attacks against Secrecy and Integrity
By spoofing Binding Updates, an attacker could redirect all packets
between two IP nodes to itself. By sending a spoofed binding update
to A, it could capture the data intended to B. That is, it could
pretend to be B and highjack A’s connections with B, or it could
establish new spoofed connections. The attacker could also send
spoofed binding updates to both A and B and insert itself in the
middle of all connections between them (man-in-the-middle attack).
Consequently, the attacker would be able to see and modify the
packets sent between A and B. See Figure 3.
Original data path, before man-in-the-middle attack
+---+ +---+
| A | | B |
+---+ +---+
\___________________________________/
Modified data path, after the falsified binding updates
+---+ +---+
| A | | B |
+---+ +---+
\ /
\ /
\ +----------+ /
\---------| Attacker |-------/
+----------+
Figure 3. Man-in-the-Middle Attack
Strong end-to-end encryption and integrity protection, such as
authenticated IPsec, can prevent all the attacks against data secrecy
and integrity. When the data is cryptographically protected, spoofed
binding updates could result in denial of service (see below) but not
in disclosure or corruption of sensitive data beyond revealing the
existence of the traffic flows. Two fixed nodes could also protect
communication between themselves by refusing to accept binding
updates from each other. Ingress filtering, on the other hand, does
not help, as the attacker is using its own address as the care-of
address and is not spoofing source IP addresses.
The protection adopted in MIPv6 Security Design is to authenticate
(albeit weakly) the addresses by return routability (RR), which
limits the topological locations from which the attack is possible
(see Section 4.1).
3.1.5. Basic Denial-of-Service Attacks
By sending spoofed binding updates, the attacker could redirect all
packets sent between two IP nodes to a random or nonexistent address
(or addresses). As a result, it might be able to stop or disrupt
communication between the nodes. This attack is serious because any
Internet node could be targeted, including fixed nodes belonging to
the infrastructure (e.g., DNS servers) that are also vulnerable.
Again, the selected protection mechanism is return routability (RR).
3.1.6. Replaying and Blocking Binding Updates
Any protocol for authenticating binding updates has to consider
replay attacks. That is, an attacker may be able to replay recently
authenticated binding updates to the correspondent and, consequently,
to direct packets to the mobile node’s previous location. As with
spoofed binding updates, this could be used both for capturing
packets and for DoS. The attacker could capture the packets and
impersonate the mobile node if it reserved the mobile’s previous
address after the mobile node has moved away and then replayed the
previous binding update to redirect packets back to the previous
location.
In a related attack, the attacker blocks binding updates from the
mobile at its new location, e.g., by jamming the radio link or by
mounting a flooding attack. The attacker then takes over the
mobile’s connections at the old location. The attacker will be able
to capture the packets sent to the mobile and to impersonate the
mobile until the correspondent’s Binding Cache entry expires.
Both of the above attacks require that the attacker be on the same
local network with the mobile, where it can relatively easily observe
packets and block them even if the mobile does not move to a new
location. Therefore, we believe that these attacks are not as
serious as ones that can be mounted from remote locations. The
limited lifetime of the Binding Cache entry and the associated nonces
limit the time frame within which the replay attacks are possible.
Replay protection is provided by the sequence number and MAC in the
Binding Update. To not undermine this protection, correspondent
nodes must exercise care upon deleting a binding cache entry, as per
section 5.2.8 ("Preventing Replay Attacks") in [6].
3.2. Attacks Against Other Nodes and Networks (Flooding)
By sending spoofed binding updates, an attacker could redirect
traffic to an arbitrary IP address. This could be used to overload
an arbitrary Internet address with an excessive volume of packets
(known as a ’bombing attack’). The attacker could also target a
network by redirecting data to one or more IP addresses within the
network. There are two main variations of flooding: basic flooding
and return-to-home flooding. We consider them separately.
3.2.1. Basic Flooding
In the simplest attack, the attacker knows that there is a heavy data
stream from node A to B and redirects this to the target address C.
However, A would soon stop sending the data because it is not
receiving acknowledgements from B.
(B is attacker)
+---+ original +---+ flooding packet +---+
| B |<================| A |==================>| C |
+---+ packet flow +---+ flow +---+
| ^
\ /
\__________________/
False binding update + false acknowledgements
Figure 4. Basic Flooding Attack
A more sophisticated attacker would act itself as B; see Figure 4.
It would first subscribe to a data stream (e.g., a video stream) and
redirect this stream to the target address C. The attacker would
even be able to spoof the acknowledgements. For example, consider a
TCP stream. The attacker would perform the TCP handshake itself and
thus know the initial sequence numbers. After redirecting the data
to C, the attacker would continue to send spoofed acknowledgements.
It would even be able to accelerate the data rate by simulating a
fatter pipe [12].
This attack might be even easier with UDP/RTP. The attacker could
create spoofed RTCP acknowledgements. Either way, the attacker would
be able to redirect an increasing stream of unwanted data to the
target address without doing much work itself. It could carry on
opening more streams and refreshing the Binding Cache entries by
sending a new binding update every few minutes. Thus, the limitation
of BCE lifetime to a few minutes does not help here without
additional measures.
During the Mobile IPv6 design process, the effectiveness of this
attack was debated. It was mistakenly assumed that the target node
would send a TCP Reset to the source of the unwanted data stream,
which would then stop sending. In reality, all practical TCP/IP
implementations fail to send the Reset. The target node drops the
unwanted packets at the IP layer because it does not have a Binding
Update List entry corresponding to the Routing Header on the incoming
packet. Thus, the flooding data is never processed at the TCP layer
of the target node, and no Reset is sent. This means that the attack
using TCP streams is more effective than was originally believed.
This attack is serious because the target can be any node or network,
not only a mobile one. What makes it particularly serious compared
to the other attacks is that the target itself cannot do anything to
prevent the attack. For example, it does not help if the target
network stops using Route Optimization. The damage is compounded if
these techniques are used to amplify the effect of other distributed
denial-of-service (DDoS) attacks. Ingress filtering in the
attacker’s local network prevents the spoofing of source addresses
but the attack would still be possible by setting the Alternate
care-of address sub-option to the target address.
Again, the protection mechanism adopted for MIPv6 is return
routability. This time it is necessary to check that there is indeed
a node at the new care-of address, and that the node is the one that
requested redirecting packets to that very address (see Section
4.1.2).
3.2.2. Return-to-Home Flooding
A variation of the bombing attack would target the home address or
the home network instead of the care-of address or a visited network.
The attacker would claim to be a mobile with the home address equal
to the target address. While claiming to be away from home, the
attacker would start downloading a data stream. The attacker would
then send a binding update cancellation (i.e., a request to delete
the binding from the Binding Cache) or just allow the cache entry to
expire. Either would redirect the data stream to the home network.
As when bombing a care-of address, the attacker can keep the stream
alive and even increase the data rate by spoofing acknowledgements.
When successful, the bombing attack against the home network is just
as serious as that against a care-of address.
The basic protection mechanism adopted is return routability.
However, it is hard to fully protect against this attack; see Section
4.1.1.
3.3. Attacks against Binding Update Protocols
Security protocols that successfully protect the secrecy and
integrity of data can sometimes make the participants more vulnerable
to denial-of-service attacks. In fact, the stronger the
authentication, the easier it may be for an attacker to use the
protocol features to exhaust the mobile’s or the correspondent’s
resources.
3.3.1. Inducing Unnecessary Binding Updates
When a mobile node receives an IP packet from a new correspondent via
the home agent, it may initiate the binding update protocol. An
attacker can exploit this by sending the mobile node a spoofed IP
packet (e.g., ping or TCP SYN packet) that appears to come from a new
correspondent node. Since the packet arrives via the home agent, the
mobile node may start the binding update protocol with the
correspondent node. The decision as to whether to initiate the