Does NAT break source port randomization?

Question

The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.

Does NAT break the security benefits of source port randomization?

In more detail, consider a client that sits behind a NAT. Suppose the client uses source port randomization for all DNS requests, and issues a request. When the request traverses the NAT, the NAT may translate the source port number to a new source port from within the NAT's pool of local port numbers.

I worry that, if the NAT uses a predictable port assignment strategy, this may derandomize the source port on the packet -- leaving the client open to a Kaminsky attack. Does this happen in practice? Do NATs translate the source port on DNS requests? Do they use predictable source ports? If this is a problem for some NATs, does anyone know how prevalent the problem is? Do NATs these days take any measures to avoid screwing up source port randomization? Is there anything one should do, when configuring a NAT, to ensure the NAT doesn't make you more vulnerable to Kaminsky attacks?

Answer 1

Obviously the implications are going to be implementation-dependent. The NAT device is free to choose any source port desired, and some implementations may have historically used sequential port numbering. But with newer hardware this is becomming increasingly unlikely.

Specifically, newer routers prefer to use the client computer's original source port (particularly for UDP) specifically to allow NAT traversal using a technique now called UDP hole punching.

At one point this was considered a sought-after feature for gaming, Skype, etc., but now it's pretty much expected.

Also, bear in mind the in most instances, the router sets itself up as the preferred DNS server for its network, then runs a forwarding resolver locally on the device. This would mean that port randomization on the client computer would be irrelevent; instead the randomization would need to be a feature of the router's DNS resolver.

Answer 2

It depends on the device doing the NAT. Most sophisticated firewalls have fingerprint scrambling features that can be enabled, for example Checkpoint has had those features since NG I believe, so a good 10 years. A basic router will not do fingerprint scrambling, it will just use the source port in the TCP packet. Some few network devices will actually map source ports to sequential numbers, but that's very rare.

So the answer to your question is almost always a qualified no, as long as your OS is using source port randomization. If your OS is using predictable source ports and you have a NAT device that doesn't randomize them for you then there's no protection against predictive attacks. If your NAT device maps to sequential source ports then it tells an attacker more about your network device than the systems inside it.

Answer 3

Even if the NAT device randomises the source ports it may still expose to DNS cache poisoning attacks, see here a research on security of patched NAT and DNS devices: http://arxiv.org/abs/1205.5190