Re: [homenet] Firewall hole punching [was: About Ted's naming architecture...]

[Lorenzo Colitti <[e-mail]>]

On Tue, Nov 22, 2016 at 5:34 PM, james woodyatt <[e-mail]> wrote:

> The recent IoT DDoS publicity is a good example; the devices that are the
> Mirai botnet are devices that had/have open ports facing the internet.
>
>
> Not quite, c.f. <https://krebsonsecurity.com/2016/10/who-makes-the-iot-
> things-under-attack/>
>
> The vast majority of those devices were protected from receiving inbound
> flows over public Internet routes by the stateful filters of IPv4/NAT
> gateways.
>

... and this knowledge is not new. The conficker paper
<https://seclab.cs.ucsb.edu/media/uploads/papers/torpig.pdf> from 2009
found that "144,236 (78.9%) of the infected machines were behind a NAT,
VPN, proxy, or firewall". We should know this by now :stateful firewalls do
not protect against malware.

It’s not about reducing attack surfaces. It’s about making systems that are
> safe for deployment in close proximity to humans.
>

+1