Bonjour Sleep Proxy service stealing IP addresses?

During September 3-13 I've seen eight Apple devices on our institution's network
steal IP addresses leased to other devices.
All the victims have all been Macintosh workstations.

I suspect that the new Bonjour Sleep Proxy service is involved.

The devices that have stolen IP addresses are:
Apple Time Capsule: 5
Apple AirPort Express: 1 (device type not yet confirmed with ower)
Mac running Mac OS X 10.6: 1
Mac running Mac OS X: 1 (device type and OS version not yet confirmed with owner)

If you monitor your network closely enough
to reconcile actual IP address usage (e.g, based on IP ARP cache data) against IP address assignments
(perhaps based on DHCP server logs), you may see this too.

I've not been able to locate published documentation of the Bonjour Sleep Proxy protocol.
(I've already seen the Apple KB article http://support.apple.com/kb/HT3774
providing an overview of the "Wake on Demand" feature, the reference
to "Sleep Proxy Servers" in http://files.multicastdns.org/draft-cheshire-dnsext-multicastdns.txt , and the Sleep Proxy Service patent in http://patft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u= %2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=7,330,986.PN.&OS=PN/7,330,986&RS =PN/7,330,986 .)

I've opened a bug report with Apple for one of the incidents (in which the thief was a Mac running Mac OS X 10.6);
in that case I was fortunate to have a system.log file from the "thief".
In my bug report I've also mentioned the Apple Time Capsule incidents too.
I'm still trying to retrieve logs from some of the other thieves and victims,
to expand my bug report with more examples.

One detail that's surprising is that one (possibly two) incidents to-date indicates that
the Bonjour Sleep Proxy Server is also present on (at least) some Mac OS X systems.
Apple's published doc to-date indicates that only Apple Time Capsules and
Apple AirPort Base Stations with 802.11n running firmware 7.4.2 provide
that service.

(I also wonder how easy it would be for someone to exploit a Bonjour Sleep Proxy Server
to launch a denial of service attack on the network to which it is attached. Without documentation about the
actual Bonjour Sleep Proxy protocol, I'm only speculating, but it seems these
Bonjour Sleep Proxy Servers accept a message that causes them to "steal" an IP address
for a period of time. What would prevent someone from sending a series of these
messages to a Bonjour Sleep Proxy Server to tell it to steal many IP addresses (on the local
IP network)...or perhaps just the IP address of the network's IP router?)

Irwin Tillman
OIT Network Systems / Princeton University

Mac Pro (early 2008), Mac OS X (10.6.1)

Posted on Sep 14, 2009 5:22 PM

19 replies

Sep 14, 2009 8:34 PM in response to irwintillman

AirPort base stations are usually purchased by home users, perhaps shockingly, for use in the home. If you're maintaining a complex network and need billions of configuration options and total control over everything every router does, your IT purchasing department should probably not be considering the for-dummies version in the first place.

Prove the attack is possible before you go setting off alarms.

irwintillman Author

Level 1

8 points

Sep 14, 2009 8:57 PM in response to Q Lazarus

Time Capsules and AirPort Base Stations are also purchased by students, faculty, and staff. And they attach them to an institution's network. (Why shouldn't a student want to attach a Time Capsule to the network, to function as a networked storage device for her personal use?) It seems reasonable to me that the owner of the device shouldn't be forced to also have the device operate as a Sleep Proxy Server.

I didn't say "alarm: an attack is possible!". I asked (given what information is currently published about how the Sleep Proxy Server works) whether it would be easy to leverage it to construct an attack. It's the sort of thing anyone who maintains a large network with lots of these devices attached is likely to ponder.

Sep 14, 2009 9:50 PM in response to irwintillman

So you allow anyone, anywhere to walk into the building and throw an open WAP on the switch to broadcast your network to the world? Most places I've seen will fire faculty and staff for doing things like that.

Bonjour's a largely open source project. Check out the sources and see how it works.

Sep 14, 2009 6:28 PM in response to irwintillman

The protocol used is documented. It's a part of mDNS. If it didn't use the actual IPs with corresponding ARPs, how else would traffic get to the proxy? Sticking the source address in the payload doesn't work because the original sender is expecting a reply from a real host not a proxy.

Message was edited by: LittleSaint

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Bonjour Sleep Proxy service stealing IP addresses?