Exploiting Sequence Number Leakage: TCP Hijacking in NAT-Enabled Wi-Fi Networks

arXiv:2404.04601v1 Announce Type: new
Abstract: In this paper, we uncover a new side-channel vulnerability in the widely used NAT port preservation strategy and an insufficient reverse path validation strategy of Wi-Fi routers, which allows an off-path attacker to infer if there is one victim client in the same network communicating with another host on the Internet using TCP. After detecting the presence of TCP connections between the victim client and the server, the attacker can evict the original NAT mapping …

arxiv attacker channel client cs.cr exploiting hijacking nat network networks path port preservation reverse routers sequence number side-channel strategy tcp uncover validation victim vulnerability wi-fi wi-fi networks