<story><title>Off-path TCP hijacking in NAT-enabled Wi-Fi networks</title><url>https://blog.apnic.net/2024/06/18/off-path-tcp-hijacking-in-nat-enabled-wi-fi-networks/</url></story><parent_chain></parent_chain><comment><author>egberts1</author><text>A whitepaper detailing this CVE-2022-32296 attack.&lt;p&gt;Vulnerability is in Double-Hash Port Selection (DHPS, IETF RFC 6056)&lt;p&gt;Fixed in Linux 5.17.9 and above using a variant of DHPS.&lt;p&gt;Linux sysctl:&lt;p&gt;net.ipv4.conf.all.rp_filter = 1&lt;p&gt;net.ipv4.conf.default.rp_filter = 1&lt;p&gt;Also Firefox Only HTTPS must be enabled to prevent JavaScript from performing dwell on hidden unsecure HTTP DOM frame.&lt;p&gt;----&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.mozilla.org&amp;#x2F;mk&amp;#x2F;questions&amp;#x2F;1359401&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.mozilla.org&amp;#x2F;mk&amp;#x2F;questions&amp;#x2F;1359401&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;arxiv.org&amp;#x2F;pdf&amp;#x2F;2209.12993&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;arxiv.org&amp;#x2F;pdf&amp;#x2F;2209.12993&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;0xkol&amp;#x2F;rfc6056-device-tracker&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;0xkol&amp;#x2F;rfc6056-device-tracker&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.rfc-editor.org&amp;#x2F;rfc&amp;#x2F;rfc6056.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.rfc-editor.org&amp;#x2F;rfc&amp;#x2F;rfc6056.html&lt;/a&gt;</text></comment>
<story><title>Off-path TCP hijacking in NAT-enabled Wi-Fi networks</title><url>https://blog.apnic.net/2024/06/18/off-path-tcp-hijacking-in-nat-enabled-wi-fi-networks/</url></story><parent_chain></parent_chain><comment><author>blahgeek</author><text>Is it common for routers to create a new mapping for TCP packets that is NOT SYN (in figure 3 in this article)? Is there a legit use case for this behavior? Wouldn&amp;#x27;t it be simpler and more secure not to do that?</text></comment>