> Given enough time and effort, at least some data will leak > about clients behind a NAT device or firewall. In many > cases, a simple footprint analysis will suffice to identify > potential targets; it doesn't require a man-in-the-middle approach.
One must be in a position to observe the leakage. There's only two ways to do that. Either the attacker must contrive to become the intended target (through cross-site scripting, social engineering, or active footprinting), or he must insert himself into the path. In the former case, the kind of intel gathered would not usually include information about live sessions to other hosts than the attacker, so it would not provide the necessary information for targeted packet spoofing. Simple Nomad once showed me a way to glean information about open ports on a host behind a firewall by pinging both the firewall and a known host that the target trusts, but it really only works on quiescent networks, and how many of those do we see these days? To get useful intel, you really need to be in the middle somewhere. > like spam, or the Code Red virus, you can inject packets > with the assumption that eventually a crafted packet will > have an effect *somewhere*, even if it isn't targeted. > ... need to consider shotgun approaches, such as many worms use. I'm not expert, but I am not aware of any worms that have relied on crafted packets with spoofed source addresses as a means to bypass NAT. Some worms have used spoofed sources to disguise the origin of DDoS attacks, but that is to be expected. On the other hand, Code Red, Nimda, Blaster, MyDoom and others have relied on (1) address sweeps and port scans to find vulnerable hosts, followed by direct connections to vulnerable listening sockets on those hosts. Not one worm in recent memory would have worked against a host behind NAT without a static translation, and without the help of a mail server or something to deliver the payload. Basically, you're saying that someone could write a tool, for example, that sends a crafted packet to every host on the Internet, port 2345, from one of Yahoo's source addresses, port 80, in hopes that his crafted packet will arrive on some stateless NAT device at a moment when an existing session exists from local port 2345 to www.yahoo.com:80, and where the application that will process the packet has the expected vulnerability. While certainly possible, the potential for success is so abysmally low that in practice nobody writes worms like that. > You're making assumptions based on things not in > your original premise. Who said only the browser process > was listening on the client? What is stopping the client > from listening on other ports, or stopping other ports > from passing the NAT device? It is not unlike me to forget my original point. :) But what I meant was, given a NAT table entry such as... Inside_Source Translated_Source Destination Age ------------- ----------------- ------------ --- 192.160.0.50:2135 216.210.201.58:17521 66.224.66.10:80 20s ..some process on the client has opened port 2135. Only that process will receive and act upon packets addressed to that port. So, in your example, an attacker who successfully spoofs a packet from 66.224.66.10:80 to 216.210.201.58:17521 will end up "talking to" whatever client process opened the session in the first place, usually a web browser. Just because you get a packet through NAT does not mean you can take your pick of listening sockets on the client. >At any rate, the point is being missed. I do that a lot. > No one is saying it's *easy* to bypass a firewall or NAT device. > What we're saying is that it can be done, and that dynamic NAT > *by itself* does not significantly enhance security. And that's where I disagree, but maybe we're just haggling over the meaning of "significantly enhance." In my book, dynamic NAT increases the difficulty of attack by at least an order of magnitude compared to machines sitting in the clear on public IPs, and certainly swats away 99.999% of the port scans and worms you see these days. To me, that's a significant enhancement. --Eric DISCLAIMER: This e-mail is intended solely for the above-mentioned recipient and it may contain confidential or privileged information. If you have received it in error, please notify us immediately at 775-885-2211 and delete the e-mail. You must not copy, distribute, disclose or take any action in reliance on it. This e-mail message and any attached files have been scanned for the presence of computer viruses. However, you are advised that you open any attachments at your own risk. DISCLAIMER: This e-mail is intended solely for the above-mentioned recipient and it may contain confidential or privileged information. If you have received it in error, please notify us immediately at 775-885-2211 and delete the e-mail. You must not copy, distribute, disclose or take any action in reliance on it. This e-mail message and any attached files have been scanned for the presence of computer viruses. However, you are advised that you open any attachments at your own risk. _______________________________________________ RLUG mailing list [EMAIL PROTECTED] http://www.rlug.org/mailman/listinfo/rlug
