Exploiting Vulnerabilities in NAT Strategies and Router Behaviors to Hijack TCP Connections in Wi-Fi Networks

Core Concepts

An off-path attacker can exploit vulnerabilities in the NAT port preservation strategy and insufficient reverse path validation of Wi-Fi routers to infer active TCP connections, evict the original NAT mappings, and reconstruct new mappings to intercept the sequence and acknowledgment numbers, enabling them to terminate, hijack, or inject traffic into the victim's TCP connections.

Abstract

The paper presents a novel off-path TCP hijacking attack in Wi-Fi networks that exploits vulnerabilities in the NAT mapping strategies and behaviors of routers. The attack consists of three main steps:

Probing the router's external IP address and identifying whether AP isolation is enabled to find potential victim clients.
Making inferences about whether there is any active TCP connection from the LAN to the target server by sending forged TCP SYN and SYN/ACK packets and observing the router's responses.
Evicting the original NAT mapping of the victim connection with forged RST packets and reconstructing a new mapping at the router by sending a TCP data packet to the server. This allows the attacker to intercept the ACK packet from the server containing the exact sequence and acknowledgment numbers of the victim connection.

After obtaining the sequence and acknowledgment numbers, the attacker can choose to launch three types of attacks: TCP Denial-of-Service (DoS) to terminate the victim's connection, TCP hijacking to take over the connection, or TCP injection to poison the victim's traffic.
The authors conduct a large-scale empirical study, testing 67 widely used router models from 30 vendors and finding that 52 of them are vulnerable to the attack. They also evaluate the attacks in 93 real-world Wi-Fi networks, finding that 75 (81%) of them are fully vulnerable. The case studies show that the attacker can terminate an SSH connection in 17.5 seconds with an 87.4% success rate, download private files from an FTP server in 19.4 seconds with an 82.6% success rate, and inject fake HTTP responses in 54.5 seconds with a 76.1% success rate.

Stats

The router has to fulfill the following conditions for the attack to succeed:

Adopts the port preservation strategy when creating new NAT mappings
Disables the reverse path validation strategy, allowing forged packets to be processed
Disables the TCP window tracking strategy, not strictly checking sequence and acknowledgment numbers
The authors find that 52 out of 67 tested router models from 30 vendors are vulnerable to the attack.

Quotes

"We uncover a new side-channel vulnerability in the widely used NAT port preservation strategy and an insufficient reverse path validation strategy of Wi-Fi routers, which allows an off-path attacker to infer if there is one victim client in the same network communicating with another host on the Internet using TCP."
"After identifying a target TCP connection, the attacker can directly get the sequence and acknowledgment numbers of the connection by exploiting a new vulnerability arising in the disabled TCP window tracking strategy of Wi-Fi routers."

Key Insights Distilled From

Exploiting Sequence Number Leakage

by Yuxiang Yang... at arxiv.org 04-09-2024

https://arxiv.org/pdf/2404.04601.pdf

Deeper Inquiries

How could router vendors improve their NAT and TCP handling strategies to prevent this type of attack?

To prevent the type of attack described in the paper, router vendors can implement several improvements in their NAT and TCP handling strategies:

Implement Strict Reverse Path Validation: Router vendors should enforce strict reverse path validation as recommended by RFC 3704. By validating the source address of incoming packets against the Forwarding Information Base (FIB), routers can prevent IP spoofing attacks and unauthorized packet forwarding.

Enable TCP Window Tracking: Router vendors should enable TCP window tracking to ensure that sequence and acknowledgment numbers in TCP packets are checked strictly. By tracking the TCP window, routers can verify the integrity of TCP connections and prevent off-path attackers from hijacking connections.

Enhance NAT Mapping Timeout Settings: Vendors should consider adjusting the timeout settings for NAT mappings, especially for the CLOSE state. By increasing the timeout duration, routers can reduce the window of opportunity for attackers to exploit vulnerabilities in the NAT mapping strategy.

Randomize Source Ports: Instead of relying solely on port preservation strategies, routers can implement randomization of source ports to mitigate the risk of port collisions and inference attacks by off-path attackers.

Regular Security Updates: Vendors should regularly release security updates and patches to address vulnerabilities in NAT and TCP handling strategies. By staying proactive in addressing security issues, vendors can enhance the overall security posture of their routers.

How could the security of Wi-Fi networks be further improved to protect against a wide range of attacks, beyond just the one presented in this paper?

To enhance the security of Wi-Fi networks and protect against a wide range of attacks, beyond those discussed in the paper, the following measures can be implemented:

Strong Encryption: Ensure that Wi-Fi networks are encrypted using WPA3 or WPA2 with strong passwords to prevent unauthorized access and eavesdropping.

Network Segmentation: Implement network segmentation to isolate critical devices and services from the rest of the network, reducing the attack surface for potential threats.

Intrusion Detection and Prevention Systems (IDPS): Deploy IDPS solutions to monitor network traffic, detect suspicious activities, and prevent potential attacks in real-time.

Regular Security Audits: Conduct regular security audits and penetration testing to identify vulnerabilities and weaknesses in the network infrastructure and address them promptly.

User Awareness Training: Educate users about best practices for Wi-Fi security, such as avoiding public Wi-Fi networks, using VPNs for secure connections, and being cautious of phishing attacks.

Multi-Factor Authentication (MFA): Implement MFA for accessing sensitive network resources to add an extra layer of security and prevent unauthorized access.

Firewall Configuration: Configure firewalls to filter incoming and outgoing traffic based on predefined security rules, blocking malicious traffic and unauthorized access attempts.

By implementing these security measures, Wi-Fi networks can be better protected against a wide range of attacks, ensuring the confidentiality, integrity, and availability of network resources and data.