3 ms·

I'd argue that NAT provides negative security in the long term. Two reasons: 1) This attack is mostly built off the complexity that NAT requires. STUN, TURN, I

I'd argue that NAT provides negative security in the long term. Two reasons: 1) This attack is mostly built off the complexity that NAT requires. STUN, TURN, ICE, ALG all exist because of NAT. More complexity == harder to secure. 2) The actual goal of the attack is to allow sending packets to hosts on your network. The only reason this is even considered an attack is because treating NAT as a security layer leads to the neglect of other security aspects. It shouldn't be a problem for your smart doormat to get random packets, but we've been allowing vendors to get away with shipping devices/software that's only safe on a 'local' network for decades. Maybe I'm wildly optimistic but if ipv6 had been the default for years and every random IoT device was expected to be exposed to the public internet by default, maybe we'd actually have something approaching decent host-level firewalling/etc by default too?

bigiain 6y ago
> The actual goal of the attack is to allow sending packets to hosts on your network. As I read it, it’s a little narrower than that. This attack allows someone to open up an unexpected port on your NAT gateway back to one specific host - the machine that ran the attack code in its browser. It, on its own, doesn’t get you to all the other hosts like the Smart Doormat or the IoT oven. (Though there’s a reasonable chance this gives the attacker, say, a redis port on your box, which gives them root, which then allows them to attack your doormat from there...)
theamk 6y ago
I think you are wildly optimistic. All the services are not magically going to become secure. Even with IPv6, every router will come with stateful firewall by default, set to "deny all incoming". And that makes sense. The security scope of "my home" makes a lot of sense. I want every computer in my house to print on the printer without extra authentication. And the tiny CPU in smart doormat can probably be overwhelmed even by a tiny DOS attack.
- jeremyjh 6y ago
  People may stop buying routers in an only IPv6 world; you'd just need a switch which are less complicated and cheaper.
  - theamk 6y ago
    Well, they basic consumers would want wifi access point, which means beefy cpu and embedded linux. So while the “router” part might be gone, the “firewall” part will be still there, since it is so cheap and provides visible benefits. And the advanced people would not buy switches as well, as they’d want some sort of dedicated firewall/IDS box.
surajs 6y ago
this was my initial impression, i don't think you're wild OR optimistic but I don't think it'll ultimately be a NAT like solution, which hasn't really been synonymous with security afaik.

bigiain 6y ago

> The actual goal of the attack is to allow sending packets to hosts on your network. As I read it, it’s a little narrower than that. This attack allows someone to open up an unexpected port on your NAT gateway back to one specific host - the machine that ran the attack code in its browser. It, on its own, doesn’t get you to all the other hosts like the Smart Doormat or the IoT oven. (Though there’s a reasonable chance this gives the attacker, say, a redis port on your box, which gives them root, which then allows them to attack your doormat from there...)

theamk 6y ago

I think you are wildly optimistic. All the services are not magically going to become secure. Even with IPv6, every router will come with stateful firewall by default, set to "deny all incoming". And that makes sense. The security scope of "my home" makes a lot of sense. I want every computer in my house to print on the printer without extra authentication. And the tiny CPU in smart doormat can probably be overwhelmed even by a tiny DOS attack.

jeremyjh 6y ago
People may stop buying routers in an only IPv6 world; you'd just need a switch which are less complicated and cheaper.
- theamk 6y ago
  Well, they basic consumers would want wifi access point, which means beefy cpu and embedded linux. So while the “router” part might be gone, the “firewall” part will be still there, since it is so cheap and provides visible benefits. And the advanced people would not buy switches as well, as they’d want some sort of dedicated firewall/IDS box.

surajs 6y ago

this was my initial impression, i don't think you're wild OR optimistic but I don't think it'll ultimately be a NAT like solution, which hasn't really been synonymous with security afaik.