Some Security Threats in a Mobile System

There are lots of security threats in a mobile system. However, only three of them are explained in this section.

3.7.1 A denial-of service attack

Generally speaking, a denial-of service attack is something that a Bad Guy does in order to prevent someone from getting useful work done. In the context of computer networking, a denial-of service attack usually takes one of the following forms:

 By sending a tremendous number of packets to a host (e.g., a Web server), a Bad Guy can make the host’s CPU processing too many useless packets. In the meantime, no useful information can be exchanged with the host while it processing the entire nuisance.

 A Bad Guy somehow interferes with the packets that are flowing between two nodes on the network. Generally speaking, a Bad Guy must be on the path between the two nodes in order wreak any such havoc [6].

In the first form attack, a popular method using spoofed Source IP Address send many TCP connection setup requests to bombard target host is known as “TCP SYN Flooding and IP Spoofing Attacks”. One reason of making spoofing possible is the fact that the IP unicast packet routing depends only on IP Destination Address without the need of the IP Source Address. This allows the attacker to spoof the IP Source Address while still being able to bombard the host with TCP connection requests.

In the second form of denial-of service attack, a Bad Guy generally, need be on the path between two corresponding hosts in order cut off their traffic flow completely. But in the case of Mobile IP, a Bad Guy can wage the denial-of service attack from anywhere in the network. As it is known, if a mobile node is connected on the foreign link, it must use registration to inform its home agent of its current care-of address to which the home agent will subsequently tunnel all packets destined to the mobile node’s home address. So a Bad Guy can send a bogus registration request message specifying his own IP Address as the care-of address for a mobile node to the home agent. Thus, all packets sent by correspondent nodes will be tunneled to the Bad Guy while the mobile node cannot get deserved services [55].

3.7.2 Replay attack

The Mobile-Home Authentication Extension prevents the denial-of service attack described above. However, it is not enough by itself, because a Bad Guy could obtain a copy of a valid Registration Request, store it, and then “reply” it at a later time, thereby registering a bogus care-of address for the mobile node. To prevent this reply attack from happening, the mobile node generates a unique value of the Identification field in each successive attempted registration. The Identification field is generated in such a way as to allow the home agent to determine what the next value should be. In this way, the Bad Guy is thwarted because the home agent will recognize the Identification field in its stored Registration Request as being out-of-date.

Mobile IP specifies two ways in which the Identification field can be chosen in order to prevent these reply attacks. The first uses timestamps, wherein the mobile node uses its current estimate for the date-and-time-of-day in the Identification field. If this estimate is not sufficiently close to the home agent’s estimate of the current time, then it rejects the mobile node’s registration and at the same time provides the mobile node with enough information to synchronize its clock to the home agent’s clock. Then, any future Identification values generated by the mobile node will be within the home agent’s tolerance [6].

The other method uses random number named as nonces. In this method, the mobile node and the home agent specify the value placed in the Identification field accordingly. If either node receives a registration message in which the Identification field does not match the expected value, then the message is rejected in the case of the home agent or ignored in the case of mobile node. Also, using the latter method, a mobile node can synchronize to the home agent [55].

3.7.3 Theft of information attack

A serious threat faced by the mobile node on the network is theft of information. Generally speaking, this kind of attack can take one of the following two methods:

 Passive Eavesdropping: As it is known, the physical security is seldom perfect and unauthorized people are often unintentionally allowed to access the network. It should be noted that wireless links can provide a serious vulnerability, in that someone need not physically be connected to the network to gain access to the information being sent across the link.

 Session-Stealing Attack: A session-stealing attack is one in which a baddy waits for a legitimate node to authenticate itself and start an application session, then takes over the session by impersonating the identity of the legitimate node. The baddy firstly wait for a mobile node to register with its home agent and eavesdrop to see if the date being sent is valuable to him. Then he floods the mobile node with nuisance packets while stealing the session by sourcing packets that appear to have come from the mobile node and by intercepting packets destinated to the mobile node. In the meantime, the user of the mobile node might has no idea that his session has been hijacked because there is no indication showing like this has occurred.