ReDAN: An Empirical Study on Remote DoS Attacks against NAT Networks

• URL: http://arxiv.org/abs/2410.21984v3
• Date: Mon, 25 Nov 2024 09:02:26 GMT
• Title: ReDAN: An Empirical Study on Remote DoS Attacks against NAT Networks
• Authors: Xuewei Feng, Yuxiang Yang, Qi Li, Xingxiang Zhan, Kun Sun, Ziqiang Wang, Ao Wang, Ganqiu Du, Ke Xu,
• Abstract summary: We show that Internet attackers operating outside local NAT networks can remotely identify a NAT device and terminate TCP connections initiated from the identified NAT device to external servers. We identify NAT devices on the Internet by exploiting inadequacies in the PMTUD mechanism within NAT specifications. Our experimental results reveal widespread security vulnerabilities in existing NAT devices.
• Score: 20.9399920902894
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In this paper, we conduct an empirical study on remote DoS attacks targeting NAT networks. We show that Internet attackers operating outside local NAT networks can remotely identify a NAT device and subsequently terminate TCP connections initiated from the identified NAT device to external servers. Our attack involves two steps. First, we identify NAT devices on the Internet by exploiting inadequacies in the PMTUD mechanism within NAT specifications. This deficiency creates a fundamental side channel that allows Internet attackers to distinguish if a public IPv4 address serves a NAT device or a separate IP host, aiding in the identification of target NAT devices. Second, we launch a remote DoS attack to terminate TCP connections on the identified NAT devices. While recent NAT implementations may include protective measures, such as packet legitimacy validation to prevent malicious manipulations on NAT mappings, we discover that these safeguards are not widely adopted in real world. Consequently, attackers can send crafted packets to deceive NAT devices into erroneously removing innocent TCP connection mappings, thereby disrupting the NATed clients to access remote TCP servers. Our experimental results reveal widespread security vulnerabilities in existing NAT devices. After testing 8 types of router firmware and 30 commercial NAT devices from 14 vendors, we identify vulnerabilities in 6 firmware types and 29 NAT devices. Moreover, our measurements reveal a stark reality: 166 out of 180 (over 92%) tested real-world NAT networks, comprising 90 4G LTE/5G networks, 60 public Wi-Fi networks, and 30 cloud VPS networks, are susceptible to exploitation. We responsibly disclosed the vulnerabilities to affected vendors and received a significant number of acknowledgments. Finally, we propose our countermeasures against the identified DoS attack.

Related papers

• TORCHLIGHT: Shedding LIGHT on Real-World Attacks on Cloudless IoT Devices Concealed within the Tor Network [16.6364461552258]
  Research revealed an unexpected pattern of substantial Tor network traffic targeting cloudless IoT devices. We developed TORCHLIGHT, a tool designed to detect both known and unknown threats targeting cloudless IoT devices by analyzing Tor traffic. For the first time, we have demonstrated that attackers are indeed using Tor to conceal their identities while targeting cloudless IoT devices.
  arXiv  Detail & Related papers  (2025-01-28T08:13:02Z)
• Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite [26.96330717492493]
  We investigate cross-layer interactions within the TCP/IP protocol suite caused by ICMP error messages. We uncover several significant vulnerabilities, including information leakage, desynchronization, semantic gaps, and identity spoofing. These vulnerabilities can be exploited by off-path attackers to manipulate network traffic stealthily, affecting over 20% of popular websites and more than 89% of public Wi-Fi networks.
  arXiv  Detail & Related papers  (2024-11-15T02:41:53Z)
• Revisiting Non-Autoregressive Transformers for Efficient Image Synthesis [82.72941975704374]
  Non-autoregressive Transformers (NATs) have been recognized for their rapid generation. We re-evaluate the full potential of NATs by revisiting the design of their training and inference strategies. We propose to go beyond existing methods by directly solving the optimal strategies in an automatic framework.
  arXiv  Detail & Related papers  (2024-06-08T13:52:20Z)
• Exploiting Sequence Number Leakage: TCP Hijacking in NAT-Enabled Wi-Fi Networks [22.72218888270886]
  We uncover a new side-channel vulnerability in the widely used NAT port preservation strategy and an insufficient reverse path validation strategy of Wi-Fi routers. Off-path attackers can infer if there is one victim client in the same network communicating with another host on the Internet using TCP. We test 67 widely used routers from 30 vendors and discover that 52 of them are affected by this attack.
  arXiv  Detail & Related papers  (2024-04-06T11:59:35Z)
• An Internet-wide Penetration Study on NAT Boxes via TCP/IP Side Channel [11.554375134328952]
  Network Address Translation (NAT) plays an essential role in shielding devices inside an internal local area network from direct malicious accesses from the public Internet. In this paper, we aim to conduct an Internet-wide penetration testing on NAT boxes. We develop an adaptive scanner that can accomplish the Internet-wide scanning in 5 days in a very non-aggressive manner.
  arXiv  Detail & Related papers  (2023-11-29T06:43:02Z)
• Revisiting Non-Autoregressive Translation at Scale [76.93869248715664]
  We systematically study the impact of scaling on non-autoregressive translation (NAT) behaviors. We show that scaling can alleviate the commonly-cited weaknesses of NAT models, resulting in better translation performance. We establish a new benchmark by validating scaled NAT models on a scaled dataset.
  arXiv  Detail & Related papers  (2023-05-25T15:22:47Z)
• On the Learning of Non-Autoregressive Transformers [91.34196047466904]
  Non-autoregressive Transformer (NAT) is a family of text generation models. We present theoretical and empirical analyses to reveal the challenges of NAT learning.
  arXiv  Detail & Related papers  (2022-06-13T08:42:09Z)
• DePA: Improving Non-autoregressive Machine Translation with Dependency-Aware Decoder [32.18389249619327]
  Non-autoregressive machine translation (NAT) models have lower translation quality than autoregressive translation (AT) models. We propose a novel and general Dependency-Aware Decoder (DePA) to enhance target dependency modeling in the decoder of fully NAT models.
  arXiv  Detail & Related papers  (2022-03-30T12:53:20Z)
• Fully Non-autoregressive Neural Machine Translation: Tricks of the Trade [47.97977478431973]
  Fully non-autoregressive neural machine translation (NAT) is proposed to simultaneously predict tokens with single forward of neural networks. In this work, we target on closing the performance gap while maintaining the latency advantage.
  arXiv  Detail & Related papers  (2020-12-31T18:52:59Z)
• Multi-Task Learning with Shared Encoder for Non-Autoregressive Machine Translation [32.77372312124259]
  Non-Autoregressive machine Translation (NAT) models have demonstrated significant inference speedup but suffer from inferior translation accuracy. We propose to adopt Multi-Task learning to transfer the Autoregressive machine Translation knowledge to NAT models through encoder sharing. Experimental results on WMT14 English-German and WMT16 English-Romanian datasets show that the proposed Multi-Task NAT achieves significant improvements over the baseline NAT models.
  arXiv  Detail & Related papers  (2020-10-24T11:00:58Z)
• Task-Level Curriculum Learning for Non-Autoregressive Neural Machine Translation [188.3605563567253]
  Non-autoregressive translation (NAT) achieves faster inference speed but at the cost of worse accuracy compared with autoregressive translation (AT) We introduce semi-autoregressive translation (SAT) as intermediate tasks. SAT covers AT and NAT as its special cases. We design curriculum schedules to gradually shift k from 1 to N, with different pacing functions and number of tasks trained at the same time. Experiments on IWSLT14 De-En, IWSLT16 En-De, WMT14 En-De and De-En datasets show that TCL-NAT achieves significant accuracy improvements over previous NAT baseline
  arXiv  Detail & Related papers  (2020-07-17T06:06:54Z)
• Smart Home, security concerns of IoT [91.3755431537592]
  The IoT (Internet of Things) has become widely popular in the domestic environments. People are renewing their homes into smart homes; however, the privacy concerns of owning many Internet connected devices with always-on environmental sensors remain insufficiently addressed. Default and weak passwords, cheap materials and hardware, and unencrypted communication are identified as the principal threats and vulnerabilities of IoT devices.
  arXiv  Detail & Related papers  (2020-07-06T10:36:11Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.