NatJack Tears Open Old NAT Assumptions
2026-08-07
NatJack does not just tweak network offense; it calls out a design mistake baked into how Network Address Translation has been used across routers and firewalls. By abusing predictable stateful translation behavior and port allocation logic, the technique turns a long‑assumed boundary into a controllable pivot for off‑path attackers.
At Black Hat, the research lands like an audit of complacency. For years, many defenders treated NAT as a quasi‑firewall, even though its core function is simple address and port rewriting within connection tracking tables and transport‑layer mappings. NatJack demonstrates that by manipulating those translation tables through crafted packets, an attacker can hijack flows, inject traffic, or punch holes that bypass higher‑level policy engines that rely on the same state.
The unsettling part is how ordinary the ingredients look. Commodity routers, carrier‑grade NAT, and enterprise gateways all share the same translation logic, shaped less by threat models than by interoperability and throughput constraints. NatJack exploits that convergence, turning the shared algorithmic assumptions of NAT traversal and connection multiplexing into a common failure mode, and leaving vendors to retrofit threat modeling onto infrastructure that was never really designed for it.
Loading...
