Hacker News Reader

Comment by tomc1985 | Hacker News Reader

tomc1985

The $10000000 question... generally speaking, am I safe from a potential drive-by infection if my PC is behind NAT? (Assuming, of course, the router is not infected or vulnerable and my computer is not DMZ)

Or is there some new attack vector that can pierce those machines reliably?

View on HN

Judging from other replies here, answer to your question is "being behind NAT is most probably safe in terms of random remote ME exploitation". But since there are other attack vectors, and since NAT can technically be circumvented (due to bugs in router, etc., which are NOT uncommon) - you should definitely disable ME if you can (and now there are tools to do that).

> being behind NAT is most probably safe

Any protection at the router level is from the firewall, not NAT, which only rewrites addresses. NAT does not provide any security benefits on it's own. (see [1] for a longer explanation)

[1] https://news.ycombinator.com/item?id=14282568

I think the idea here is being that if NAT is used, in the most common meaning, that usually means that the machine behind the router is not Internet-routable. There is no address which can be reached from the internet, that will go to the machine directly. (Which has actual security benefits.)

Of course the abbreviation "NAT" really has a broader meaning, and one can of course set up certain network configurations where the machine would still be Internet-routable, even though NAT is used for something, or the other way around, etc.

Is this what you meant? Judging by the link it seems so. A clarification could be important, so do you suggest perhaps that the question should have been more like "If my machine does not have a direct Internet address, due to NAT configuration, am I safe from ME exploits"?

> There is no address which can be reached from the internet

Maybe read my previous [1] again?

If you are behind a NAT only - which would be highly unusual - you probably can send packets to it from the internet. The router will simply forward packets that have an internal (RFC 1918) DST address.

That only thing NAT does is rewrite address fields. The reason you usually cannot receive packets directly from the internet is due to the stateful firewall.

> "If my machine does not have a direct Internet address, due to NAT configuration, am I safe from ME exploits"?

s/NAT/firewall/

Drive by downloads are very much an issue regardless of NATing. Taking advantage of browser exploits or bugs to download and execute arbitrary code/executables. note: this is common in compromised or malicious ad networks, so just safe browsing habits are not necessarily enough.

I was thinking more in-terms of attacks requiring zero user interaction. But you are right that NAT has no interaction with unwitting-user-type drive-by downloads

It’s safest to never consider NAT and security in the same thought, for a few reasons. Two come to mind right away: IPv6 is pushing us toward less NAT, and laptops go other places and interact with other networks than your own.

Also (as feikname points out in another comment) because if you're relying on your NAT for security, your security boundary becomes your network, not your machine. If you read post-mortems of security breaches, it's really common for the initial intrusion to be a printer, or webcam, or an intern's/secretary's/nonprivileged user's device, which then pivots using the internal network to gain more access.

IPv6 is also pushing towards a more firewall-heavy network rather than a firewall-less network, usually a NAT implies the presence of a firewall though.

I am no security expert, but if a machine in the local network gets infected and tries to access your ME, then NAT can't prevent the attack. That's the only other vector I can think of.

There's the danger of automated updates, if they are not signed or if the key is compromised.

The NotPetya malware infected a large number of machines by being injected into the update server of a company which developed a tax preparation program. When the program fetched the new "update", the machine got infected.

Reply on news.ycombinator.com