full-disclosure - Re: NAT router inbound network traffic subversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1106926622.9371.67.camel@localhost.localdomain>
From: khermansen at ht-technology.com (Kristian Hermansen)
Subject: Re: NAT router inbound network traffic subversion

I think the answers that I received in response to my query are somewhat
obvious -- yes -- but neither answered my question!  Morning Wood's
analysis was brilliant as ever, like always ;-P

"atacker now can do a he wishes to the rest of your network ( GAME
OVER )"

Ummm...okay.  The problem with you was this statement:

"NAT client browses web..."

HOW IS THIS NOT USER INTERACTION?!?!?  I asked if there is a computer on
the internal network that doesn't do anything -- that means SENDING NO
PACKETS to the router -- if an attacker can get EVEN ONE PACKET inside:
then they will prove everyone wrong, right?  If one packet can get
through, it can be considered a rogue packet that should not have
entered the internal network destined for a particular host -- or better
yet -- an internal broadcast address going to all hosts.

Some say getting these rogue packets into the network is "impossible".
That is the reason for my question.  I like to think that most problems
are "intractable", but not "impossible".  Can anyone prove me wrong?
Can someone push a rogue packet behind a router with no client
interaction???  This is my chautauqua...
-- 
Kristian Hermansen <khermansen@...technology.com>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050128/27080c35/attachment.bin