NAT "Slipstream" exploit

[sixwheeledbeast]

Slipstream exploit published this week allows an attacker to access any TCP/UDP service bypassing any NAT or firewall by just visiting a website with some malicious javascript.

 

[james.wilson]

Wow, that gives endless possibilities. Is it patched on the main browsers yet? 

[sixwheeledbeast]

It's not necessarily just a browser issue, as I understand it javascript via a browser is just an easier way to execute it.

In summary it finds the internal IP of the browsing computer via WebRTC. If WebRTC is not available a TCP timing attack is performed to detect valid subnets trying to establish the machines internal IP.
Used in conjunction with "an abuse of the TURN authentication mechanism causing IP packets to overflow" a valid SIP registration connection is requested.
The SIP connection request tricks ALG in the router to open a requested port for the attacker to exploit further. The router will now forward any port requested by the attacker who now has access via the compromised PC.

A simple solution would be to disable Javascript on your browser but so much of the web uses scripts this wouldn't be viable for most.
Disabling WebRTC from within your browser would be one way to limit your private IP being broadcast to the internet but this exploit employs other methods to try and establish this information.
Disabling ALG on your router (normally under NAT) for example should stop it completely, however you may have issues with routing SIP connections or other services that require ALG like RTSP.

It may also be possible that ALG implementation in affected routers be patched somehow, the proof of concept was on a Netgear R7000 not sure if testing has been done on every brand, something to keep an eye on.

 

According to the developer:-

Quote

Ideally ALGs become disabled by default and browsers restrict ALG-specific ports for all outbound socket features they support other than necessary (for example, allow SIP via WebRTC, but not HTTP, HTTPS, FTP, STUN, TURN, TURNS, etc)

 

[james.wilson]

Agreed but it looks like initial exploit is from a bad website or ad within a legit site. That then runs the code (based on browser and as the developer is on apple safari was tested hard) I see how the scan of local IP works based on the seeing what responds time wise. I assume this attack is primerly looking for ways into the host machine, do you think it could be used to attack anything on the local subnet? 

[sixwheeledbeast]

That's the most worrying thing yes it can be an external source, it could in theory be a legit site that has loaded a bad advert via a third party.

Safaris WebRTC support is limited so this is where the "scanning" of the local network was required, I read it that the timing attack would be done on any browser if WebRTC didn't give out the IP. The exploit needs to know the browsing computers private IP to start the attack and make it look like a SIP request to trigger ALG. This timing attack method takes time so I would expect to see a delay in website/pages loading.

If successful it would provide access to anything on that subnet behind the firewall, beyond that it would depend on what's on the subset that can be accessed from that PC.

 

I see what you mean, if things could be done in the browsers this would roll out to people pretty quickly. Disabling settings in the router or any patching/upgrading firmware is very unlikely to be done by the average person and take while to get released.

I would say for now disabling ALG if you don't need it would be sensible tho.

 

 

 

 

[sixwheeledbeast]

Considered an enhancement to be in Firefox 84

[james.wilson]

Glad to see