In [_NAT Slipstreaming v2.0_](https://sa.my/slipstream/), Samy Kamkar documents research developed with Ben Seri and Gregory Vishnipolsky showing how a webpage can manipulate networking behavior well beyond the boundary we normally associate with a browser.

> “NAT Slipstreaming allows an attacker to remotely access any TCP/UDP service bound to any system behind a victim’s NAT, bypassing the victim’s NAT/firewall.”

What I find fascinating is that the attack does not depend on one obviously broken component. It chains together browser behavior, packet boundaries, protocol confusion, NAT connection tracking, and application-level gateways.

Each layer can appear to be doing its intended job, while the assumptions between those layers create the vulnerability.

It is a good reminder that abstractions are not automatically security boundaries. Compatibility features built to make old and complicated protocols work can also create paths through protections we assume are solid.

Read the full research: [_NAT Slipstreaming v2.0_ by Samy Kamkar](https://sa.my/slipstream/)

In <a href="https://sa.my/slipstream/">NAT Slipstreaming v2.0</a>, Samy Kamkar documents research developed with Ben Seri and Gregory Vishnipolsky showing how a webpage can manipulate networking behavior well beyond the boundary we normally associate with a browser.
<blockquote>
“NAT Slipstreaming allows an attacker to remotely access any TCP/UDP service bound to any system behind a victim’s NAT, bypassing the victim’s NAT/firewall.”
</blockquote>
What I find fascinating is that the attack does not depend on one obviously broken component. It chains together browser behavior, packet boundaries, protocol confusion, NAT connection tracking, and application-level gateways.
Each layer can appear to be doing its intended job, while the assumptions between those layers create the vulnerability.
It is a good reminder that abstractions are not automatically security boundaries. Compatibility features built to make old and complicated protocols work can also create paths through protections we assume are solid.
Read the full research: <a href="https://sa.my/slipstream/">NAT Slipstreaming v2.0 by Samy Kamkar</a>

In [_NAT Slipstreaming v2.0_](https://sa.my/slipstream/), Samy Kamkar documents research developed with Ben Seri and Gregory Vishnipolsky showing how a webpage can manipulate networking behavior well beyond the boundary we normally associate with a browser.

, Samy Kamkar documents research developed with Ben Seri and Gregory Vishnipolsky showing how a webpage can manipulate networking behavior well beyond the boundary we normally associate with a browser.

“NAT Slipstreaming allows an attacker to remotely access any TCP/UDP service bound to any system behind a victim’s NAT, bypassing the victim’s NAT/firewall.”

What I find fascinating is that the attack does not depend on one obviously broken component. It chains together browser behavior, packet boundaries, protocol confusion, NAT connection tracking, and application-level gateways.

Each layer can appear to be doing its intended job, while the assumptions between those layers create the vulnerability.

It is a good reminder that abstractions are not automatically security boundaries. Compatibility features built to make old and complicated protocols work can also create paths through protections we assume are solid.

Read the full research: [_NAT Slipstreaming v2.0_ by Samy Kamkar](https://sa.my/slipstream/)

Compatibility features that make old protocols work can also open paths through network protections we assume are already solid.