New NAT/Firewall Bypass Attack Lets Hackers Access Any TCP/UDP Service

guest · Nov 2, 2020

New NAT/Firewall Bypass Attack Lets Hackers Access Any TCP/UDP Service
November 2, 2020
https://thehackernews.com/2020/11/new-natfirewall-bypass-attack-lets.html

A new research has demonstrated a technique that allows an attacker to bypass firewall protection and remotely access any TCP/UDP service on a victim machine.

Called NAT Slipstreaming, the method involves sending the target a link to a malicious site (or a legitimate site loaded with malicious ads) that, when visited, ultimately triggers the gateway to open any TCP/UDP port on the victim, thereby circumventing browser-based port restrictions.
The findings were revealed by privacy and security researcher Samy Kamkar over the weekend.

"NAT Slipstreaming exploits the user's browser in conjunction with the Application Level Gateway (ALG) connection tracking mechanism built into NATs, routers, and firewalls by chaining internal IP extraction via timing attack or WebRTC, automated remote MTU and IP fragmentation discovery, TCP packet size massaging, TURN authentication misuse, precise packet boundary control, and protocol confusion through browser abuse," Kamkar said in an analysis.
Click to expand...

NAT Slipstreaming works by taking advantage of TCP and IP packet segmentation to remotely adjust the packet boundaries and using it to create a TCP/UDP packet starting with a SIP method such as REGISTER or INVITE.
In other words, a mix of packet segmentation and smuggling SIP requests in HTTP can be used to trick the NAT ALG into opening arbitrary ports for inbound connections to the client.

The whole proof-of-concept code for NAT Slipstreaming can be found here.
Click to expand...

Log in or Sign up

New NAT/Firewall Bypass Attack Lets Hackers Access Any TCP/UDP Service

guest Guest

Log in or Sign up

New NAT/Firewall Bypass Attack Lets Hackers Access Any TCP/UDP Service

guest Guest

Useful Searches