Re: NAT router inbound network traffic subversion

["morning_wood" <se_cur_ity () hotmail com>]

scenario...

NAT client browses web...
NAT client initates a HTTP request to do this...
ROUTER returns the request to NAT client...
( normal activity )

attacker website exploits client browser...
exploit drops and executes "badfile.exe"
"badfile.exe" hooks iexplore.exe...

"badfile.exe" is 'reverse connecting trojan'...
"badfile.exe" initiates a HTTP  request to do this...
attacker's "badfile.exe"' 'client' is waiting with a HTTP server...

the new hooked browser initiates a HTTP request to the attacker.
NAT client is now connected to the attacker
through the ROUTER ( kinda like browsing the web huh? )
attacker now has unrestricted packet via the NAT client,
that is where ??? BEHIND YOUR ROUTER

atacker now can do a he wishes to the rest of your network
( GAME OVER )


Cheers,
m.w
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html