Subject: RE: [midcom] STUN security showstopper

From: Adina Simu <[email-masked]>
Date: Fri, 10 May 2002 15:44:36 -0700

At 05:12 PM 5/10/2002 -0500, Sanjoy Sen wrote:

>Will the packet be properly routed in the private domain (behind NAT)?

This depends on how the routing is configured -- but, chances are it will 
be properly routed. BTW same routing is needed in case of 2 clients behind 
the same NAT wishing to talk to each other:

Inside the local domain, there must be routes configured for the domain's 
Global addresses pointing to the Global Internet. (it might be a good idea 
to incorporate this routing config recommendation within the STUN doc).

> > -----Original Message-----
> > From: Adina Simu [<mailto:[email-masked]>mailto:[email-masked]]
> > Sent: Friday, May 10, 2002 5:06 PM
> > To: [email-masked]
> > Cc: [email-masked]
> > Subject: RE: [midcom] STUN security showstopper
> >
> >
> > (this might have been already proposed and rejected, if this
> > is the case I
> > apologize)
> >
> > Once the client receives the STUN response containing a
> > MAPPED ADDRESS, one
> > way to verify that the address really points (belongs) to him
> > is to ping a
> > server in the Global space, using as source address the
> > MAPPED ADDRESS. The
> > ping packet should go through NATs untranslated, and it will
> > hit the Global
> > space with the same MAPPED address as source address. The
> > reply will be
> > destined to MAPPED address. If the client receives the reply,
> > mapped-address is indeed his.
> >
> > The server should not be the STUN server (in case somebody
> > snoops packets
> > destined to the STUN server). It could be the client's
> > proxy... or similar.
> >
> > -Adina
> >
> >  >> In a very limiting deployment scenario, the STUN service
> > may be configured
> >  >> with the possible (expected) IP addresses of all NATs in
> > the serving
> >  >> domain.
> >
> >  > That will certainly help against interception by 3rd
> > parties that are on
> >  > the path between the NAT and the server. It will not help
> > in the shared
> >  > access network scenario, since the attacker and the target
> > are behind
> >  > the same NAT, and thus use the same set of plausible IP addresses.
> >
> >  > -- Christian Huitema
> >
> >
> > _______________________________________________
> > midcom mailing list
> > [email-masked]
> > 
> <https://www1.ietf.org/mailman/listinfo/midcom>https://www1.ietf.org/mailman/listinfo/midcom 
>
> >

---

From: "Alan Hawrylyshen" <[email-masked]>
Date: Fri, 10 May 2002 19:00:48 -0600

At 05:12 PM 5/10/2002 -0500, Sanjoy Sen wrote:
>This depends on how the routing is configured -- but, chances are it
will be properly
>routed. 

Not at a site with reasonably strict router or firewall rules.
It is not unusual to configure equipment to drop packets that are
'malformed'.
A packet claiming to originate from the public address space which
appears on the interface of a router / firewall that is in a closed
private network will be dropped by many configurations.. Especially in
networks configured with the ' deny all , explicitly permit' security
policy.

I do not think it is safe to count on this.

Alan Hawrylyshen
Jasomi Networks Inc

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom