5 ms·
If your public IP from your ISP is 12.13.14.15, and your internal block is 192.168.0.0/24, then your ISP can send a packet to 12.13.14.15 destined for 192.168.0
by bandrami 10mo ago
If your public IP from your ISP is 12.13.14.15, and your internal block is 192.168.0.0/24, then your ISP can send a packet to 12.13.14.15 destined for 192.168.0.7, and without a firewall your router will happily forward it. An attacker who can convince intervening routers to send traffic destined for 192.168.0.7 to 12.13.14.15 (and these attacks do exist, particularly over UDP) can also do that.
- ErroneousBosh 10mo agoOkay, so not only do you have to create a bogus packet, you have to convince every piece of equipment in between you and the end user to collude with it, in the hopes that the final router is so woefully misconfigured as to act upon it?
- bandrami 10mo agoThe ISP is the primary threat vector here (do you trust yours? Along with their contractors and anyone who might have compromised them?). But like I said route-poisoning attacks do exist.
- ErroneousBosh 10mo agoYes, I trust everyone who works at it, mostly because I know where they live.
- bandrami 10mo agoDo you trust the state actors who have compromised it?
- kstrauser 10mo agoOr more likely, network engineers who’ve been subpoenaed to collect the information? Your scenario is plausible for high value targets. Like, what country wouldn’t want to have a friendly tech working at the ISP most politicians use in DC? That doesn’t seem improbable. For the regular Joe Schmoe, I’d be more concerned with court-ordered monitoring.
- ErroneousBosh 9mo agoAh, that sounds like an American problem. If you're in the US, you're living in a hostile surveillance state that makes North Korea look like a hippy commune.
- kstrauser 9mo agoOh yes, subpoenas are a uniquely American problem. eyeroll.png
- ErroneousBosh 9mo agoI know all the people that work at it.
- sedawkgrep 10mo agoyeah but the likelihood of this is incredibly remote. It would shock me if ISPs didn't have alarms going off if RFC1918 space was suddenly routable within their BGP table. Not to mention the return packet would be NAT'd so the attacker would have to deal with that complication.
- bandrami 10mo agoYou're missing the part where the ISP is the one doing it
- ErroneousBosh 10mo agoMm. Can you give an example of that happening in real life?
- bandrami 10mo agoGoogle "Eagerbee"
- sedawkgrep 10mo agoNot finding anything saying that ISPs have anything to do with Eagerbee.
- bandrami 10mo agoISPs were the vector for Eagerbee. Don't trust your next-hop router.
- ErroneousBosh 9mo agoThere's nothing on Google about that.
- Dagger2 10mo agoThe return packet wouldn't be NATed, because stateful NAT tracks connections and only applies NAT to packets that belong to outbound connections. Arguing over how likely this is is missing the point. If it can happen at all when you're running NAT, then it should be clear that NAT isn't providing security.
- tsimionescu 10mo agoYou're using somewhat sloppy terminology that will confuse things. An IP packet can't be addressed both to 12.13.14.15 AND to 192.168.0.7. The realistic attack here is that your ISP sends a packet with destination address 192.168.0.7 to the MAC of your router (the MAC that corresponds to 12.13.14.15). This is a realistic attack scenario if the device that your router connects directly to gets compromised (either by an attacker or by the ISP itself). Getting a public route that would take packets destined for 192.168.0.7 to reach your router over the Internet is far more unlikely.
- bandrami 9mo agoTrue, the frame is addressed to the router's hw interface but I'm talking to people who think NAT drops traffic so I figured keep it simple But, yes, the ISP (or whoever has compromised/suborned/social engineered the ISP) is absolutely the main worry here and I don't understand how people are dismissing that so easily
- kortilla 9mo ago> I don't understand how people are dismissing that so easily Because that’s not where 99.9999% of attacks come from Fire up a web server on a public ipv4 address and you’ll get hundreds of requests per day from bots probing endpoints for vulnerabilities. Same thing goes for weak passwords on an SSH endpoint.
- kortilla 9mo agoNo, the router will only forward it with specific implementations that don’t isolate routing tables between the external and internal. Or an easier approach is just a stateless ACL on the external interface. Neither are a stateful firewall.