ReDAN: An Empirical Study on Remote DoS Attacks against NAT Networks

Xuewei Feng,Yuxiang Yang,Qi Li,xingxiang Zhan,Kun Sun,Ziqiang Wang,Ao Wang,Ganqiu Du,Ke Xu

2024-10-29

Abstract:In this paper, we conduct an empirical study on remote DoS attacks targeting NAT networks. We show that Internet attackers operating outside local NAT networks can remotely identify a NAT device and subsequently terminate TCP connections initiated from the identified NAT device to external servers. Our attack involves two steps. First, we identify NAT devices on the Internet by exploiting inadequacies in the PMTUD mechanism within NAT specifications. This deficiency creates a fundamental side channel that allows Internet attackers to distinguish if a public IPv4 address serves a NAT device or a separate IP host, aiding in the identification of target NAT devices. Second, we launch a remote DoS attack to terminate TCP connections on the identified NAT devices. While recent NAT implementations may include protective measures, such as packet legitimacy validation to prevent malicious manipulations on NAT mappings, we discover that these safeguards are not widely adopted in real world. Consequently, attackers can send crafted packets to deceive NAT devices into erroneously removing innocent TCP connection mappings, thereby disrupting the NATed clients to access remote TCP servers. Our experimental results reveal widespread security vulnerabilities in existing NAT devices. After testing 8 types of router firmware and 30 commercial NAT devices from 14 vendors, we identify vulnerabilities in 6 firmware types and 29 NAT devices. Moreover, our measurements reveal a stark reality: 166 out of 180 (over 92%) tested real-world NAT networks, comprising 90 4G LTE/5G networks, 60 public Wi-Fi networks, and 30 cloud VPS networks, are susceptible to exploitation. We responsibly disclosed the vulnerabilities to affected vendors and received a significant number of acknowledgments. Finally, we propose our countermeasures against the identified DoS attack.

Cryptography and Security,Networking and Internet Architecture

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to conduct an empirical study on the vulnerability of remote DoS (Denial of Service) attacks in NAT (Network Address Translation) networks. Specifically, the authors show how external Internet attackers can remotely identify NAT devices and terminate TCP connections initiated from these devices, thereby threatening the communication relying on NAT networks.

### Main problems

1. **Remote identification of NAT devices**: The paper points out that the existing NAT specifications have deficiencies in handling the Path MTU Discovery (PMTUD) mechanism, which leads to a fundamental side - channel vulnerability. Attackers can use this vulnerability to distinguish whether a public IPv4 address belongs to a NAT device or an independent IP host, and then identify the target NAT device.

2. **Remote termination of TCP connections**: Once the NAT device is identified, the attacker can send a constructed RST (Reset) packet to deceive the NAT device to wrongly remove the legitimate TCP connection mapping, thus interrupting the communication between the client inside the NAT and the external server.

### Solutions and contributions

- **Revealing side - channel vulnerabilities**: The paper reveals the information leakage problem in the NAT specification caused by insufficient consideration of the PMTUD mechanism.

- **Evaluating the security of different NAT implementations**: Through tests on multiple operating systems, router firmware, and commercial NAT routers, it is found that most of the actually deployed NAT devices are vulnerable to this attack.

- **Widespread practical impacts**: The experimental results show that among the 180 real - world NAT networks tested, more than 92% (i.e., 166) are at risk of being attacked, including scenarios such as public Wi - Fi, 4G/5G networks, and cloud networks.

- **Proposing countermeasures**: It is recommended to improve the NAT specification to fix the side - channel problem, and it is recommended that NAT devices implement stricter TCP packet legality checks, especially verifying the sequence number of the received RST packets, to prevent attackers from manipulating session mappings.

Through the above research, the paper not only reveals the security risks existing in the current NAT networks but also provides specific improvement suggestions for enhancing the security of NAT networks.