On Fri, 5 Mar 2004, Robinson, Eric R. wrote:
> as to what sorts of packet mangling Todd is talking about, and how
> mangled packets could be used to leverage an unauthorized inbound
> connection. (Not saying it cannot be done, I just don't see how off the
> top of my head.)
The two most common types of mangling for firewalking are twiddling of the
TCP flags, and packet fragmentation. If your intent is just to stuff
packets down a link, you don't even have to provide a valid source IP
address. So...
> Inside_Source Translated_Source Destination Age
> ----------------- -------------------- --------------- ---
> 192.168.1.50:2345 216.210.201.58:35112 66.94.230.36:80 30s
- A packet could be spoofed from 66.94.230.36:80. Some specially crafted
packets can wreck havoc on certain applications, create buffer
overflows, or whatever. Even just spoofing FIN or RST packets could
cause issues.
- If the connection isn't torn down properly between 192.168.1.50 and
66.94.230.36 before the timer expires, this connection can potentially
be hijacked.
- Malicious packet fragments could be passed through the NAT device, and
cause havoc when reassembled. Unless the NAT device does its own
packet reassembly, it offers no protection.
- Depending on how your NAT device handles TCP flags, one might be able
to trick your NAT device into passing packets. Perhaps your NAT device
doesn't inspect packets with the SYN/ACK flag set.
- In this particular example, there's no indication the NAT device
differentiates between TCP and UDP. Even if it does, UDP tables are
usually timer-based, so some devices won't even try to match up IP
sockets. Even if they do, there's no transport-layer flag to tear down
the connection, leaving it live until the timer expires.
All of this assumes that your NAT device is partly a firewall, and is
tracking state. Many don't; they just look for packets with an ACK flag.
If yours is one of those, then "U w1ll b3 0wn3d."
NAT itself does nothing to enhance security. However, stateful packet
inspection will definitely help, in which case we're no longer talking
strictly about NAT. :)
Either way, if a crafted packet gets in, and generates a reply packet...
well, you may now have a legitimate entry point into the network,
complete with an entry in the state tables allowing further
communication.
--
Todd's "Customer Disservice Hall of Shame" currently contains:
- Charter Communications: Mislead their customers about service
levels, block normal Internet connectivity, and exhibit excessive
downtime.
- AT&T: Honoring the "checks" they send out to entice you to switch
long-distance providers is apparently optional.
- eFax: Receive (not send) 20 pages of *unsolicited* faxes, and lose
your account.
_______________________________________________
RLUG mailing list
[EMAIL PROTECTED]
http://www.rlug.org/mailman/listinfo/rlug
