On Jul 12, 2011, at 1:45 AM, Jeff Wheeler wrote: > On Tue, Jul 12, 2011 at 4:06 AM, Damien Saucez > <[email protected]> wrote: >> However, in our mail exchanges, I said that the cache management was more >> than a security problem >> and was more important than just negative replies. You can inject a lot of >> entries with positive replies as >> well, particularly in IPv6. You can have this by massively de aggregating >> the prefixes. Again, this is > > As I have mentioned, a malicious person does not need access to any > LISP infrastructure. They will not need to inject new prefixes. All > an attacker must do is send packets in a systemic manner to exploit > the way LISP MS negative replies work -- by sending back > non-overlapping negative responses,
Just so I can understand, are you saying that the attack may send unsolicited Map-Replies to an ITR? Or are you suggesting you send, say, a syn packet with a spoofed source to a host within the site, expecting the resultant syn-ack to result in a map-request sent into the mapping system? -Darrel _______________________________________________ lisp mailing list [email protected] https://www.ietf.org/mailman/listinfo/lisp
