News for hackers. Stuff that matters.

A comment on Pwnat – Autonomous Nat Traversal (2010).

Re:Pwnat – Autonomous Nat Traversal (2010) by noname120 on Tuesday September 17, 2019 @03:21AM (#20992539)
> This will work behind many NATs and firewalls, but not all.

While this is an interesting concept, the hard part in NAT traversal is getting it to work on all the possible NAT types. In particular, I believe that this method doesn't work for symmetric NAT devices[1], which are widespread in corporate environments. It's not a surprise that this idea from 2010 didn't take off, ICE/TURN are still kings.

[1] These devices assign a different port for each destination address, and this ICMP method doesn't help predict the port that will be assigned.

[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by archergod on Tuesday September 17, 2019 @08:42AM (#20994282)
2010? Samy (author of pwnat) is the person jailed for hacking MySpace using this Code. He write this code in 2005 or 2007 something, He upload to his site in 2010, but this code is very old, and I was the first one to compile it on windows back than. It works, but for limited devices back then. It is very respectable code in itself.
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by knd775 on Tuesday September 17, 2019 @10:14AM (#20995303)
He didn't "[hack] MySpace using this code". He just used XSS.
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by lozaning on Tuesday September 17, 2019 @11:17AM (#20996160)
He's still my hero though!
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by jgeralnik on Tuesday September 17, 2019 @03:43AM (#20992637)
As long as only one side of the connection is behind a corporate NAT you could simply try all 65535 ports until you find the one that works. The side behind the NAT would receive the packet and then be able to respond.
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by noname120 on Tuesday September 17, 2019 @04:07AM (#20992794)
And then you're blacklisted by the corporate firewall for doing what looks like port scanning.
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by jacobush on Tuesday September 17, 2019 @06:05AM (#20993371)
All 3 corporate firewalls I have been behind have been HTTP only. No actual internet connection. (Except for DNS, which worked.)
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by imglorp on Tuesday September 17, 2019 @07:52AM (#20993871)
DNS working in a corporate IT environment is a surprise. Often, clients are issued an internal DNS server via DHCP, and outbound DNS to arbitrary servers is blocked. This helps mitigate DNS hijacking and also allows some additional outbound domain filtering and logging.
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by jacobush on Tuesday September 17, 2019 @08:10AM (#20993987)
Oh, yes, DNS is an internal DNS. You can't change it. I meant, it's the only way to "trickle leak" data without it going through the filtering proxy. But who knows, maybe the DNS requests are logged too, but they don't seem to be filtered.

Edit: they are filtered. Suspicious names go to 127.0.0.1

[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by imglorp on Tuesday September 17, 2019 @08:18AM (#20994049)
You can leak names can't you? Wouldn't kinda-short-secret-message.foo.example.com make its way eventually to the authoritative server for example.com, as long as it's not too sketchy a domain?
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by jacobush on Tuesday September 17, 2019 @08:36AM (#20994217)
Yep, that works.
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by big_chungus on Tuesday September 17, 2019 @10:37AM (#20995618)
And of course, with the advent of DNS over HTTPS, this is no longer as effective. I can still access blocked sites and get around logging, I just have to set up a tunnel to cloudflare.
[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by jlg23 on Tuesday September 17, 2019 @12:55PM (#20997374)
Which, from a security point of view, would be grounds for immediate termination and quite some companies I worked for would try to sue you to pay for impact assessment.

(connecting a usb-modem is much safer, I'd have to actually spot the device which would require getting out of my chair... ;)

[ Parent | on HN ]
Re:Pwnat – Autonomous Nat Traversal (2010) by big_chungus on Tuesday September 17, 2019 @02:22PM (#20998459)
The point is not really for me to circumvent restrictions, it's more that a bad actor could. This can largely defeat the purpose; though malware using this is not common, it's started to crop up.
[ Parent | on HN ]