Full Report
NAT bypassing techniques recently published by researchers are particularly dangerous for OT networks of industrial enterprises
Analysis Summary
# Tool/Technique: NAT Slipstreaming (v2.0)
## Overview
NAT Slipstreaming is a sophisticated technique that allows an attacker to bypass a victim’s Network Address Translation (NAT) and firewall to remotely access any TCP/UDP service on a protected internal host. It works by tricking a router's Application Level Gateway (ALG) into opening ports by sending specially crafted traffic that mimics legitimate protocols (like SIP, H.323, or FTP) through a web browser.
## Technical Details
- **Type:** Technique / Attack Vector
- **Platform:** OS-agnostic (targets Network Gateways/Routers and Web Browsers)
- **Capabilities:** Protocol manipulation, firewall traversal, internal network scanning.
- **First Seen:** October 2020 (v1.0 by Samy Kamkar); January 2021 (v2.0 by Armis researchers).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise
- **TA0005 - Defense Evasion**
- T1562.004 - Impair Defenses: Disable or Modify System Firewall
- **TA0008 - Lateral Movement**
- T1210 - Exploitation of Remote Services
## Functionality
### Core Capabilities
- **ALG Manipulation:** Exploits the Application Level Gateway (ALG) feature in routers designed to facilitate protocols that require multiple connections (like VoIP or FTP).
- **Internal Port Mapping:** By sending a hidden request via a browser (JavaScript), the attacker forces the NAT/firewall to open a pinhole to an internal IP address and port that would otherwise be blocked.
- **Protocol Smuggling:** v2.0 utilizes the H.323 protocol or multiple SIP packets to bypass earlier browser-side restrictions on forbidden ports.
### Advanced Features
- **Browser-Based Trigger:** Requires only that a victim inside the network visits a malicious website; no malware installation is required on the endpoint.
- **Remote Access to OT/ICS:** In industrial environments, this can bypass the "boundary" between IT and OT networks, exposing PLCs or HMIs directly to the internet.
- **TCP Mid-Stream Injection:** Allows an attacker to inject data into an existing session to fool the router into seeing a "secondary connection" request.
## Indicators of Compromise
- **File Hashes:** N/A (Technique is typically fileless/browser-based).
- **File Names:** N/A.
- **Network Indicators:**
- Unusual outbound traffic to port 5060 (SIP) or 1720 (H.323) from standard workstations not using VoIP.
- Large TCP segments or fragmented packets designed to overflow MTU or hide protocol headers.
- Traffic directed to `http[:]//[attack_domain]:5060` or `http[:]//[attack_domain]:1720`.
- **Behavioral Indicators:**
- Sudden appearance of inbound connections to internal assets (PLCs, RDP, VNC) originating from the gateway IP.
## Associated Threat Actors
- While originally disclosed by security researchers (Samy Kamkar and Armis), the technique has been monitored for adoption by advanced persistent threat (APT) groups focusing on industrial espionage and OT network penetration.
## Detection Methods
- **Signature-Based:** Detect multi-line SIP/H.323 headers or characters like `\n` or `\r` embedded within browser-initiated HTTP POST requests.
- **Behavioral Detection:** Monitor for "Pinhole" creation logs on enterprise Grade-firewalls. Detect browsers attempting to connect to non-standard HTTP ports (1720, 5060, etc.).
- **IDS/IPS:** Look for the "Slipstream" pattern where a packet contains an internal IP address in the payload of a protocol it shouldn't be associated with.
## Mitigation Strategies
- **Browser Updates:** Ensure all browsers are updated to versions that block the ports used by this technique (e.g., Chrome/Edge >= 87, Firefox >= 84).
- **Disable Disused ALGs:** Disable SIP, H.323, and FTP ALGs on all company routers and firewalls if they are not strictly required for business operations.
- **Deep Packet Inspection (DPI):** Use firewalls capable of inspecting the state and validity of protocol handshakes rather than just header inspection.
- **Network Segmentation:** Implement strict DMZs and ensure OT devices do not have a direct route to the internet gateway.
## Related Tools/Techniques
- **NAT Traversal:** Standard STUN/TURN/ICE techniques.
- **UPnP Exploitation:** Similar goal of opening firewall ports but via different protocols.
- **DNS Rebinding:** Often used in conjunction with NAT Slipstreaming to identify internal IP addresses of targets.