← Back to release summary

Block HTTP ports 69, 137, 161, 1719, 1720, 1723, and 6566

Category
Network / Connectivity
Type
No developer-visible change
Status
Enabled by default (Chrome 87)
Intent stage
Prepare to ship

Summary

Connections to HTTP, HTTPS or FTP servers on ports 69, 137, 161, 1719, 1720, 1723 or 6566 will fail. This is a mitigation for the NAT Slipstream 2.0 attack: https://www.armis.com/resources/iot-security-blog/nat-slipstreaming-v2-0-new-attack-variant-can-expose-all-internal-network-devices-to-the-internet/. It helps developers by keeping the web platform safe for users.

Motivation

The NAT Slipstream 2.0 attack is a kind of cross-protocol request forgery which permits malicious internet servers to attack computers on a private network behind a NAT device. The attack depends on being able to send traffic on port 1720 (H.323). To prevent future attacks, this change also blocks several other ports which are known to be inspected by NAT devices and may be subject to similar exploitation.

Standards & signals

View on chromestatus.com