New NatJack Attacks Enable TCP Session Hijacking

Security researcher Malcolm Stagg disclosed an attack class called NatJack that manipulates NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. The behavior was found across independently developed implementations in Windows and Linux.