4 ms·
yeah but the likelihood of this is incredibly remote. It would shock me if ISPs didn't have alarms going off if RFC1918 space was suddenly routable within thei
by sedawkgrep 9mo ago
yeah but the likelihood of this is incredibly remote. It would shock me if ISPs didn't have alarms going off if RFC1918 space was suddenly routable within their BGP table.
Not to mention the return packet would be NAT'd so the attacker would have to deal with that complication.
- bandrami 9mo agoYou're missing the part where the ISP is the one doing it
- ErroneousBosh 9mo agoMm. Can you give an example of that happening in real life?
- bandrami 9mo agoGoogle "Eagerbee"
- sedawkgrep 9mo agoNot finding anything saying that ISPs have anything to do with Eagerbee.
- bandrami 9mo agoISPs were the vector for Eagerbee. Don't trust your next-hop router.
- ErroneousBosh 9mo agoThere's nothing on Google about that.
- Dagger2 9mo agoThe return packet wouldn't be NATed, because stateful NAT tracks connections and only applies NAT to packets that belong to outbound connections. Arguing over how likely this is is missing the point. If it can happen at all when you're running NAT, then it should be clear that NAT isn't providing security.
- kortilla 9mo ago“if it protects 99.999% of attackers from reaching you but not this one specific attacker in this one case of misconfiguration, it’s not providing security”… Dude, that’s a really shitty take and this is why people that do care about security end up ignoring advice from anyone who thinks this way. You’re in the camp of “don’t use condoms because they can break”.
- Dagger2 9mo agoNAT doesn't protect you from 99.999% of attackers though. It doesn't do anything to incoming connections, so it actually protects you from 0% of attackers.
- ErroneousBosh 9mo agoOkay, but unless you've poked a hole through NAT (and if you have, presumably you know what you're doing), what are those incoming connections going to connect to? If there's nothing to connect to, is there really an incoming connection?
- Dagger2 9mo agoThey connect to whatever IP is specified in the packet's "destination IP" header field. It's exactly the same behavior as if there was no NAT going on.
- kortilla 9mo agoThe destination IP header from the internet belongs to the router. There is nothing internal to connect to without NAT.