{"id":"https://openalex.org/W4412170976","doi":"https://doi.org/10.1109/ton.2025.3586020","title":"Off-Path TCP Hijacking Attack to NAT-Enabled Wi-Fi Networks","display_name":"Off-Path TCP Hijacking Attack to NAT-Enabled Wi-Fi Networks","publication_year":2025,"publication_date":"2025-07-10","ids":{"openalex":"https://openalex.org/W4412170976","doi":"https://doi.org/10.1109/ton.2025.3586020"},"language":"en","primary_location":{"id":"doi:10.1109/ton.2025.3586020","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ton.2025.3586020","pdf_url":null,"source":{"id":"https://openalex.org/S5407042750","display_name":"IEEE Transactions on Networking","issn_l":"2998-4157","issn":["2998-4157"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Networking","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5073667806","display_name":"Yuxiang Yang","orcid":"https://orcid.org/0009-0005-7582-5917"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuxiang Yang","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0005-7582-5917","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100562906","display_name":"Xuewei Feng","orcid":null},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuewei Feng","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-3736-6623","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100350165","display_name":"Qi Li","orcid":"https://orcid.org/0000-0001-8776-8730"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qi Li","raw_affiliation_strings":["Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-8776-8730","affiliations":[{"raw_affiliation_string":"Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026728546","display_name":"Kun Sun","orcid":"https://orcid.org/0000-0003-4152-2107"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kun Sun","raw_affiliation_strings":["CSIS, Department of Information Sciences and Technology, George Mason University, Fairfax, VA, USA"],"raw_orcid":"https://orcid.org/0000-0003-4152-2107","affiliations":[{"raw_affiliation_string":"CSIS, Department of Information Sciences and Technology, George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100400481","display_name":"Ziqiang Wang","orcid":"https://orcid.org/0000-0003-0216-4968"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ziqiang Wang","raw_affiliation_strings":["School of Cyber Science and Engineering, Southeast University, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-0216-4968","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Southeast University, Nanjing, China","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ao Wang","orcid":"https://orcid.org/0009-0000-4324-9189"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ao Wang","raw_affiliation_strings":["School of Cyber Science and Engineering, Southeast University, Nanjing, China"],"raw_orcid":"https://orcid.org/0009-0000-4324-9189","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Engineering, Southeast University, Nanjing, China","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100665814","display_name":"Ke Xu","orcid":"https://orcid.org/0000-0003-2587-8517"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ke Xu","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-2587-8517","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.7006,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.72888089,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"33","issue":"6","first_page":"3270","last_page":"3285"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11896","display_name":"Opportunistic and Delay-Tolerant Networks","score":0.9927999973297119,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11896","display_name":"Opportunistic and Delay-Tolerant Networks","score":0.9927999973297119,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11158","display_name":"Wireless Networks and Protocols","score":0.991100013256073,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.9890000224113464,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/nat","display_name":"Nat","score":0.7337534427642822},{"id":"https://openalex.org/keywords/tcp-hole-punching","display_name":"TCP hole punching","score":0.6681889891624451},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.6247296333312988},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5483608245849609},{"id":"https://openalex.org/keywords/path","display_name":"Path (computing)","score":0.4536322057247162},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.34097298979759216},{"id":"https://openalex.org/keywords/transmission-control-protocol","display_name":"Transmission Control Protocol","score":0.27120327949523926},{"id":"https://openalex.org/keywords/tcp-acceleration","display_name":"TCP acceleration","score":0.1780756413936615},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.05303722620010376}],"concepts":[{"id":"https://openalex.org/C182516595","wikidata":"https://www.wikidata.org/wiki/Q376660","display_name":"Nat","level":2,"score":0.7337534427642822},{"id":"https://openalex.org/C190362163","wikidata":"https://www.wikidata.org/wiki/Q7669759","display_name":"TCP hole punching","level":5,"score":0.6681889891624451},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.6247296333312988},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5483608245849609},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.4536322057247162},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.34097298979759216},{"id":"https://openalex.org/C33588617","wikidata":"https://www.wikidata.org/wiki/Q8803","display_name":"Transmission Control Protocol","level":3,"score":0.27120327949523926},{"id":"https://openalex.org/C101452262","wikidata":"https://www.wikidata.org/wiki/Q7669757","display_name":"TCP acceleration","level":4,"score":0.1780756413936615},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.05303722620010376}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ton.2025.3586020","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ton.2025.3586020","pdf_url":null,"source":{"id":"https://openalex.org/S5407042750","display_name":"IEEE Transactions on Networking","issn_l":"2998-4157","issn":["2998-4157"],"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Networking","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7155321176","display_name":null,"funder_award_id":"62132011","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W1590544288","https://openalex.org/W1692207811","https://openalex.org/W1867219652","https://openalex.org/W2041188073","https://openalex.org/W2070670160","https://openalex.org/W2117175761","https://openalex.org/W2118715238","https://openalex.org/W2133467782","https://openalex.org/W2403165337","https://openalex.org/W2525730961","https://openalex.org/W2754338111","https://openalex.org/W2767098552","https://openalex.org/W2892310063","https://openalex.org/W2904172073","https://openalex.org/W2988979713","https://openalex.org/W3016124431","https://openalex.org/W3043946492","https://openalex.org/W3082884087","https://openalex.org/W3096245080","https://openalex.org/W3204548492","https://openalex.org/W3212980631","https://openalex.org/W4210630158","https://openalex.org/W4229016148","https://openalex.org/W4230038347","https://openalex.org/W4243835522","https://openalex.org/W4288057715","https://openalex.org/W4385080273","https://openalex.org/W4400021111"],"related_works":["https://openalex.org/W1999225540","https://openalex.org/W2124127379","https://openalex.org/W4255967616","https://openalex.org/W3821134","https://openalex.org/W2765788376","https://openalex.org/W2058185285","https://openalex.org/W2368619280","https://openalex.org/W2104434117","https://openalex.org/W2418753158","https://openalex.org/W2374981490"],"abstract_inverted_index":{"In":[0,113],"this":[1,114],"paper,":[2],"we":[3,177],"uncover":[4],"a":[5,48],"novel":[6],"side-channel":[7],"vulnerability":[8,258],"arising":[9],"from":[10,122,165,223],"the":[11,38,52,65,86,90,95,104,116,123,127,137,142,145,152,157,243,246,257],"shared":[12,39,96],"NAT":[13,35,40,68,92,97],"tables":[14],"of":[15,106,172,192,235,245,278],"Wi-Fi":[16,54,78,186,252],"routers,":[17],"enabling":[18],"malicious":[19],"insiders":[20],"to":[21,139,156,198,216,263],"hijack":[22],"TCP":[23,101,107,120],"connections":[24],"between":[25],"other":[26],"clients":[27],"and":[28,72,125,130,168,188,211,226,238,259,267,276],"remote":[29],"servers.":[30],"First,":[31],"by":[32],"creating":[33],"different":[34],"mappings":[36],"within":[37,51],"table,":[41],"an":[42,59,81,179],"off-path":[43],"attacker":[44,87,117,138],"can":[45,88,118],"infer":[46],"whether":[47],"victim":[49],"client":[50],"same":[53],"network":[55],"is":[56,84],"communicating":[57],"with":[58,99,232],"external":[60],"host":[61],"over":[62],"TCP,":[63],"leveraging":[64],"widely":[66,162],"adopted":[67],"port":[69],"preservation":[70],"strategy":[71],"insufficient":[73],"reverse":[74],"path":[75],"validation":[76],"in":[77,94,110,134,147,249],"routers.":[79,112],"Once":[80],"active":[82],"connection":[83],"detected,":[85],"manipulate":[89],"victim\u2019s":[91],"mapping":[93],"table":[98],"spoofed":[100],"packets,":[102],"exploiting":[103],"lack":[105],"window":[108],"tracking":[109],"most":[111],"way,":[115],"intercept":[119],"packets":[121,155,231],"server":[124],"obtain":[126],"current":[128],"sequence":[129],"acknowledgment":[131],"numbers,":[132],"which":[133],"turn":[135],"allows":[136],"forcibly":[140],"close":[141],"connection,":[143],"poison":[144],"traffic":[146],"plain":[148],"text,":[149],"or":[150],"reroute":[151],"server\u2019s":[153],"incoming":[154],"attacker.":[158],"We":[159,241,254],"test":[160],"67":[161],"used":[163],"routers":[164],"30":[166],"vendors":[167,266],"discover":[169],"that":[170,190,205],"52":[171],"them":[173,193],"are":[174,195],"vulnerable.":[175],"Also,":[176],"conduct":[178],"extensive":[180],"measurement":[181],"study":[182,203],"on":[183,214],"93":[184],"real-world":[185],"networks":[187],"find":[189],"75":[191],"(81%)":[194],"fully":[196],"affected":[197,265],"our":[199,279],"attack.":[200],"Our":[201],"case":[202],"shows":[204],"it":[206],"takes":[207],"about":[208],"17.5,":[209],"19.4,":[210],"54.5":[212],"seconds":[213],"average":[215],"terminate":[217],"SSH":[218],"connections,":[219],"download":[220],"private":[221],"files":[222],"FTP":[224],"servers,":[225],"inject":[227],"fake":[228],"HTTP":[229],"response":[230],"success":[233],"rates":[234],"87.4%,":[236],"82.6%,":[237],"76.1%.":[239],"Moreover,":[240],"evaluate":[242],"feasibility":[244],"proposed":[247],"attack":[248],"NAT-enabled":[250],"IPv6":[251],"networks.":[253],"responsibly":[255],"disclose":[256],"suggest":[260],"mitigation":[261],"strategies":[262],"all":[264],"have":[268],"received":[269],"positive":[270],"feedback,":[271],"including":[272],"acknowledgments,":[273],"CVEs,":[274],"rewards,":[275],"adoption":[277],"suggestions.":[280]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}