BadTunnel: How Do I Get Big Brother Power?
summary
Claims a long standing Windows NetBIOS name service design flaw lets a remote host trigger the OS to open a double-direction UDP 137 tunnel through NAT by inducing failed UNC access, leaking the incremental MBNS transaction ID and allowing forged name replies. It works across Windows releases back to Windows 95 and can hijack wpad and other names to control proxy and name resolution. Microsoft ships a June patch that stops MB name queries after failed UNC lookups; mitigations: disable NetBIOS over TCP/IP or block port 137.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 0:44Speaker background
- 2:37NetBIOS protocol
- 8:27Creating a bad tunnel
- 12:37Bad tunnel attacks
- 16:35Defense and mitigation
- 20:45Demo and Q&A
related talks
47mFinding a Needle in an Encrypted Haystack
01h 06mComputrace Backdoor Revisited
38mTunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
38mHi! My Name Is [What?]: Abusing DHCP To Spoof DNS Records
18mCounterfeiting the Pipes with FakeNet 2.0 (Part 2/2)
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
41mBreaking Kerberos' RC4 Cipher and Spoofing Windows PACs