Opening closed ports on NAT device and bypassing stateful firewalls with BeEF

-http://blog.beefproject.com/2012/07/opening-closed-ports-on-nat-device-and.html-

 

Eww, nasty. I cannot wait until malicious sites start using remote exploits, instead of tired old drive-by downloads.

Anyway... How would UFW's default configuration for iptables fair against such an attack? And what about Windows software firewalls? Would I be wrong in suspecting an interactive firewall might be safer in this case?

 

AppArmor can limit your program and resitrct them from being able to use protocols like IRC, which are necessary for protocol spoofing (haven't read it yet, assuming that's what this is.)

An outbound Firewall would prevent this as well by locking the program to specific ports.

 

So the key there is that the user has some kind of server (FTP, ssh, etc) running. If you don't there's nothing to forward.

http://samy.pl/natpin/

 

I'd probably want to make sure 135-139 and 445 were closed as well. I've found internet accessible shares that were meant to be private because those ports were open.

 

Doesn't Windows, by default, keep ports open beneath its firewall though?

 

There are at least 3 open ports on Windows by default for the NetBIOS or something else.