full-disclosure - NAT router inbound network traffic subversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b61dda9fca1c5ab210bff66e7f158e6e@intrusense.com>
From: lists at intrusense.com (Darren Bounds)
Subject: NAT router inbound network traffic subversion

You should probably clarify exactly what type of NAT implemenation 
you're speaking about. After all, it's perfectly common to leverage 
dedicated static NATs to support inbound connections for internal (and 
typically non-routed) hosts.


Thank you,

Darren Bounds
Intrusense, LLC.


On Jan 28, 2005, at 1:12 AM, Kristian Hermansen wrote:

> I have Googled around and asked a highly-respected Professor at my
> University whether it is possible to direct packets behind a NAT router
> without the internal 192.168.x.x clients first requesting a connection
> to the specific host outside.  The answer I received is "not possible".
> I also asked if this can be thought of as a security feature, to which
> the reply was again "yes".
>
> Now, I wouldn't place all my bets on his answer and I am calling on
> someone out there to clear up my question.  If NAT really does only
> allow inbound connections with a preliminary request as he suggests, it
> seems that the only way to get an "unauthorized" packet behind the
> router is by some flaw in the firmware of the device.
>
> How about if the client has requested a connection to Google.com from
> behind his Linksys home NAT router: would it be possible for an outside
> attacker to spoof packets from Google's IP to get packets into the
> network?  Or do we need to know the sequence numbers as well?  Or is
> there an even more devious way to get packets on the inside without a
> client's initiative?
>
> Has there been any research into this?  Are there statistics on worm
> propagation and exploited network hosts in relation to those 
> individuals
> that did not own routers (and instead connected directly to their
> modem)?  If *all* home users on the Internet had NAT routers during the
> summer of 2003, would we have significantly slowed the spread of
> Blaster?  I believe these all to be very important questions and the
> security aspects of the ability to route packets behind NAT really
> interests me...maybe some of you can elaborate :-)
> -- 
> Kristian Hermansen <khermansen@...technology.com>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html