Abstract:In this paper, we conduct an empirical study on remote DoS attacks targeting NAT networks. We show that Internet attackers operating outside local NAT networks can remotely identify a NAT device and subsequently terminate TCP connections initiated from the identified NAT device to external servers. Our attack involves two steps. First, we identify NAT devices on the Internet by exploiting inadequacies in the PMTUD mechanism within NAT specifications. This deficiency creates a fundamental side channel that allows Internet attackers to distinguish if a public IPv4 address serves a NAT device or a separate IP host, aiding in the identification of target NAT devices. Second, we launch a remote DoS attack to terminate TCP connections on the identified NAT devices. While recent NAT implementations may include protective measures, such as packet legitimacy validation to prevent malicious manipulations on NAT mappings, we discover that these safeguards are not widely adopted in real world. Consequently, attackers can send crafted packets to deceive NAT devices into erroneously removing innocent TCP connection mappings, thereby disrupting the NATed clients to access remote TCP servers. Our experimental results reveal widespread security vulnerabilities in existing NAT devices. After testing 8 types of router firmware and 30 commercial NAT devices from 14 vendors, we identify vulnerabilities in 6 firmware types and 29 NAT devices. Moreover, our measurements reveal a stark reality: 166 out of 180 (over 92%) tested real-world NAT networks, comprising 90 4G LTE/5G networks, 60 public Wi-Fi networks, and 30 cloud VPS networks, are susceptible to exploitation. We responsibly disclosed the vulnerabilities to affected vendors and received a significant number of acknowledgments. Finally, we propose our countermeasures against the identified DoS attack.

SoK: A Literature and Engineering Review of Regular Expression Denial of Service

Regular Expression Attack Technique On ReDoS Vulnerability

Exploiting Input Sanitization for Regex Denial of Service

ReScue: Crafting Regular Expression DoS Attacks

Runtime Recovery of Web Applications under Zero-Day ReDoS Attacks

A systematic review on distributed denial of service attack defense mechanisms in programmable networks

A Comprehensive Survey on Ddos Defense Systems: New Trends and Challenges

DDoS Attack and Defense: Review of Some Traditional and Current Techniques

A Survey of Distributed Denial of Service Attacks and Defenses

ReDAN: An Empirical Study on Remote DoS Attacks against NAT Networks

A Review of Denial of Service Attack and Mitigation in the Smart Grid Using Reinforcement Learning

20 Years of DDoS: a Call to Action

DDoS attacks and machine‐learning‐based detection methods: A survey and taxonomy

DDoSMiner: an Automated Framework for DDoS Attack Characterization and Vulnerability Mining.

IXmon: Detecting and Analyzing DRDoS Attacks at Internet Exchange Points

The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS Assessments

Regexes are Hard: Decision-making, Difficulties, and Risks in Programming Regular Expressions

A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks

SmartReco: Detecting Read-Only Reentrancy via Fine-Grained Cross-DApp Analysis

Towards Risk Evaluation of Denial-Of-Service Vulnerabilities in Security Protocols

Systematic Literature Review of IoT Botnet DDOS Attacks and Evaluation of Detection Techniques