On Wed, 12 July 2000, Danny McPherson wrote:
The primary goal of the BGP MD5 signature option is to protect the TCP substrate from introduction of spoofed TCP segments such a TCP RSTs. These segments could easily be injected from anywhere on the Internet.
BGP MD5 signatures do not protect the TCP/IP stream from spoofed TCP RSTs. The MD5 signature is checked at the BGP application layer after passing through and being acted on by the TCP stack. You can play all sorts of MAC, ARP, ICMP, IP and TCP games with the stream which MD5 won't prevent. Why we haven't seen more of these attacks I don't know for sure.
On 12 Jul 2000, Sean Donelan wrote:
Why we haven't seen more of these attacks I don't know for sure.
I'll venture a guess -- most attackers are interested in compromising UNIX boxes, not routers. ~Dan D. -- __________________________________________________________________ -- The trouble with doing something right the first time is that -- nobody appreciates how difficult it was. ++ Dan Debertin ++ Senior Systems Administrator ++ Bitstream Underground, LLC ++ airboss@bitstream.net ++ (612)321-9290
participants (2)
-
Dan Debertin -
Sean Donelan