[Full-Disclosure] NAT router inbound network traffic subversion

From: Kristian Hermansen (khermansen_at_ht-technology.com)
Date: 01/28/05

  • Next message: rohit_at_kritikalsolutions.com: "[Full-Disclosure] Sify: ISP in India using hubs to provide connectivity" 
    To: full-disclosure@lists.netsys.com
Date: Fri, 28 Jan 2005 01:12:19 -0500

    I have Googled around and asked a highly-respected Professor at my
    University whether it is possible to direct packets behind a NAT router
    without the internal 192.168.x.x clients first requesting a connection
    to the specific host outside. The answer I received is "not possible".
    I also asked if this can be thought of as a security feature, to which
    the reply was again "yes".

    Now, I wouldn't place all my bets on his answer and I am calling on
    someone out there to clear up my question. If NAT really does only
    allow inbound connections with a preliminary request as he suggests, it
    seems that the only way to get an "unauthorized" packet behind the
    router is by some flaw in the firmware of the device.

    How about if the client has requested a connection to Google.com from
    behind his Linksys home NAT router: would it be possible for an outside
    attacker to spoof packets from Google's IP to get packets into the
    network? Or do we need to know the sequence numbers as well? Or is
    there an even more devious way to get packets on the inside without a
    client's initiative?

    Has there been any research into this? Are there statistics on worm
    propagation and exploited network hosts in relation to those individuals
    that did not own routers (and instead connected directly to their
    modem)? If *all* home users on the Internet had NAT routers during the
    summer of 2003, would we have significantly slowed the spread of
    Blaster? I believe these all to be very important questions and the
    security aspects of the ability to route packets behind NAT really
    interests me...maybe some of you can elaborate :-) 

    -- 
Kristian Hermansen <khermansen@ht-technology.com>

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: rohit_at_kritikalsolutions.com: "[Full-Disclosure] Sify: ISP in India using hubs to provide connectivity"

    Relevant Pages

    • Re: Yet another thread on the legality of port scanning
      ... >> The normal means of communicating on the internet is via IP ... >> packets. ... hardware/software can't survive a port scan, ... > is an acceptable connection in the absence of explicit permission? ...
      (Security-Basics)
    • Re: Linksys Firmware Upgrade Available
      ... A router does not block outgoing packets. ... an NAT router will not stop it. ... With a firewall, you can block programs, ports and protocols. ... You have a linksys one of these linksys ...
      (comp.security.firewalls)
    • Intenet Connection Problems
      ... I am having a problem getting internet access... ... recently tried installing a wireless card which for some ... My connection status would stay constant.... ... says 42 Packets sent, and 0 Packets received....Another ...
      (microsoft.public.win2000.networking)
    • default FORWARD policy?
      ... I have a setup where a box is acting as a firewall and NAT router. ... boxes' ability to send packets to the outside world (i.e. my firewall is to ... of ACCEPT for the FORWARD chain? ...
      (comp.os.linux.security)
    • Re: Linksys WRT54G and Firewall software
      ... in another network although NAT router and XP SP2 FW are basically doing the same, why does that reason not apply to the NAT router as well? ... But the NAT router is directly connected to the internet connection and it is completely unprotected on the LAN side. ... NAT thus drops any packets which it does not know where to send them. ...
      (comp.security.firewalls)