Subject: Re: [rtcweb] Consent alternative

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 23 Jan 2014 08:55:16 +0000

> -----Original Message-----
> From: Martin Thomson [mailto:[email-masked]]
> Sent: Thursday, January 23, 2014 9:43 AM
> To: Tirumaleswar Reddy (tireddy)
> Cc: Muthu Arul Mozhi Perumal (mperumal); Cullen Jennings (fluffy);
> [email-masked]
> Subject: Re: [rtcweb] Consent alternative
> 
> On 22 January 2014 18:01, Tirumaleswar Reddy (tireddy)
> <[email-masked]> wrote:
> > I am still referring to off-path attacker only who can sniff packets and spoof
> IP address but cannot modify or consume packets.
> 
> How exactly is this attacker able to generate a valid heartbeat ?

In the example attack you had mentioned, Attacker B knows both the master secret and STUN short-term username/password. It will sniff the heartbeat request sent by A, spoof IP address of C and send valid heartbeat response. Same problem exists with STUN consent. 

-Tiru.