1

Introduction

I am currently trying to build up a networking layer for Unity from scratch. Currently I am testing the communication via UDP using Node.js for the server and the client. However I guess the language of the implementation will not matter for what I am asking for.

Current approach

The current approach using Node.js for the server and the client is pretty basic. I simply send a packet from a client to my server while the client and the server are not in the same local network. Both are behind a router and therefore also behind a NAT.

The server then sends back an answer to the IP and port received within the UDP packet that was sent from the client.

Problem

I am curious about the security on the client side regarding to ports being opened on the client machines and routers. So far I assumed that I don't need to do anything to secure the client from attackers or anything else that can do something with the ports that are used by my application. The following assumption shows why I think that I don't need to do anything to secure the clients.

Assumption

  1. Server is setting up callbacks.

  2. Server starts listening to a specific port which is also forwarded to the servers machine within the router.

  3. Server now will call a callback when a UDP message was received. The server then will send a UDP message to the address and the port of the client obtained by the message received.

  4. Client is setting up callbacks.

  5. Client starts listening to port 0 which for Node.js's dgram means:

    For UDP sockets, causes the dgram.Socket to listen for datagram messages on a named port and optional address. If port is not specified or is 0, the operating system will attempt to bind to a random port. - https://nodejs.org/api/dgram.html#dgram_socket_bind_port_address_callback

    • So the operating system now knows that packets sent to this port belong to my application.
    • Nobody can use this for something malicious.
  6. Client, which knows the servers address and port, starts the process of sending a UDP message to the server.

  7. Clients router receives the UDP message. NAT creates a random port (used on the public side) and maps it to the clients (local) address and port.

    • So the router now knows that packets sent to the public address and the newly generated port belong to the local address and port.
    • Nobody can use this for something malicious.
  8. Clients router sends UDP message containing the public address and the NAT generated port to the server.

    • The worst thing that can happen is that a man-in-the-middle attacker can read the data the client is sending. Due to it is only gamedata like positions and so on that is sent this is not a big problem while developing the basics.
    • Nobody can use this for something malicious.
  9. Server receives the message and calls the callback described in 3. So the server sends to the public address and the NAT generated port of the client.

    • The worst thing that can happen is that a man-in-the-middle attacker can read the data the server is sending. Due to it is only gamedata like positions and so on that is sent this is not a big problem while developing the basics.
    • Nobody can use this for something malicious.
  10. Same as 7. with the servers router and the servers local address and port.

  11. Same as 8. with the servers router.

  12. Client receives the UDP message of the server and calls a callback which processes the message contents.

    • Due to the local port of the client is bound to my application only nobody can use this for something malicious due to I simply ignore the contents if they are not from the real server.

Question

So is my assumption correct and I really don't need to secure the client from any attacks that will harm the clients in any way?

0

If a malicious host somehow knows the IP and UDP addresses being used in the conversation, it could spoof the NAT and client into thinking that they are receiving data from the server, when it is really bad data from the malicious host.

How that could damage the host depends on the process in the host that receives the bad data, and what the process does with the bad data. Unfortunately, applications, programming, and protocols above OSI layer-4 are all off-topic here. To learn more about what could happen in your specific circumstance, you could try to ask on Stack Overflow, where there are many network-savvy programmers.

  • Thanks a lot for your reply! I asked the same question on Stack Overflow as well. I didn't even think about it yet what might happen on layers above 4. But what about the layers below layer 4? Will an attacker be able to to something malicious by simply knowing that the NAT generated port was used to send a UDP message to a server? I am not talking about the data that might be sent by an attacker. Will this port be something like a hole where I cannot even do anything against it because the attacker is using it for something that does not even reach my application? – Bee Mar 27 '17 at 12:42
  • Other than a DoS, the damage comes from what an attacked device does with the malicious data. For example, layers 3 and 4 simply pass the payloads up to the next layer in the network stack, and those are going to need to look legitimate (correct IP and UDP addresses) to get passed up the stack. It is the payload of the UDP datagram that could possibly be damaging if the application process is poorly constructed. – Ron Maupin Mar 27 '17 at 14:15
  • Right. This is really a Stack Overflow question, but you could use hash signatures on the data, encrypt the data, use a VPN, etc. You should be able to get better guidance from the programmers. They are probably going to want more detail about the application than you have provided here. – Ron Maupin Mar 27 '17 at 15:21
  • So in summary the data within a UDP message is the only potential threat (that I can do something against) for the clients. This means that I need to figure out (using Stack Overflow) how to build my application in a way that makes it invulnerable against malicious data. Right? Edit: Sorry I accidently posted my comment before I finished it and deleted it. Is your answer still valid to my updated question? – Bee Mar 27 '17 at 15:21
  • Sorry I accidently posted my comment before I finished it and deleted it. Is your answer still valid to my updated question? – Bee Mar 27 '17 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.