Re: RE: Réf. : RE: Thoughts on the impact of Signalling security on IP traffic

[Gorry Fairhurst <gorry@erg.abdn.ac.uk>]

If the cost is indeed 10's of thousands of dollars for an MPEG-Mux and
terrestrial Modulator/Amp, - then this clearly makes this an expensive
attack for an individual to mount. Maybe though if the signal disappears, I
should still look out for a truck outside? :-).

In an IP network, my concerns would likely be orientated towards the
possible injection of data that modifies the flow of IP packets that are
forwarded to a Receiver network, particularly if modifications may go
undetected. 

It may be that there is an implicit reliance on the validity of the MPEG-2
signalling data ... (and hence the identity of the equipment multiplexing
the data)..., and that for most applications, the physical security of the
equipment means this is valid assumption?

Gorry

---

Right...
It is possible that someone could suitably equip a truck, drive it into a
neighborhood and overpower the RF that arrives at the nearby homes.
Interception and retransmission for replacement requires very low processing
delay such that the real signal appears as  reflection (pre-ghost) that the
receiver can cancel/ignore. (If those technical constraints are not met,
nothing is received - that is it effectively is simply a RF jammer - no
standard can stop that. While I don't have quotes, certainly it would cost
several 10s of thousands US dollars for the equipment; and for the homes in
the next torus where it did not swamp the receivers it would seriously
interfere with reception (jammer again).  While determination of
interference sources can be hard, the large panel truck with antennas on
might help in this case.  If the attacker were an apartment dweller, he
perhaps could impact neighbors in a similar manner and be more difficult to
detect.   But it is not clear what benefit could be obtained from this
localized denial of service attack that many nearby would detect as lost of
regular TV programming.

After all the potential attacker can directly obtain all of the data stream
and process it without interfering with anyone.
I fail to see that discussion of a terrestrial spoofing attack is worthy of
further time or IP packets.  But have it...

______________
Art Allison
Director, Advanced Engineering
Science & Technology
National Association of Broadcasters
1771 N St. NW
Washington DC 20036
202 429 5418