Subject: [core] #371 (resource-directory): DDoS security consideration

From: "core issue tracker" <[email-masked]>
Date: Wed, 23 Jul 2014 18:26:49 -0000

#371: DDoS security consideration

 Add a security consideration with regard to DDoS and resource directories,
 proposed text from Mohit Sethi is as follows:

    Services that run over UDP unprotected are vulnerable to unknowingly
    become part of a DDoS attack as UDP does not require return
    routability check.  Therefore, an attacker can easily spoof the
    source IP of the target entity and send requests to such a service
    which would then respond to the target entity.  This can be used for
    large-scale DDoS attacks on the target.  Especially, if the service
    returns a response that is order of magnitudes larger than the
    request, the situation becomes even worse as now the attack can be
    amplified.  DNS servers have been widely used for DDoS amplification
    attacks.  Recently, it has been observed that NTP Servers, that also
    run on unprotected UDP have been used for DDoS attacks (http://
    tools.cisco.com/security/center/content/CiscoSecurityNotice/
    CVE-2013-5211) [TODO: Ref] since there is no return routability check
    and can have a large amplification factor.  The responses from the
    NTP server were found to be 19 times larger than the request.  A
    Resource Directory (RD) which responds to wild-card lookups is
    potentially vulnerable if run with CoAP over UDP.  Since there is no
    return routability check and the responses can be significantly
    larger than requests, RDs can unknowingly become part of a DDoS
    amplification attack.  Therefore, it is recommended that
    implementations must ensure return routability.  This can be done,
    for example by responding to wild card lookups only over DTLS or TLS
    or TCP.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-core-resource-
  [email-masked]     |  [email-masked]
     Type:  task         |     Status:  new
 Priority:  minor        |  Milestone:
Component:  resource-    |    Version:
  directory              |   Keywords:
 Severity:  -            |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/core/trac/ticket/371>
core <http://tools.ietf.org/core/>