Exploring NATJack: How NAT Manipulation Breaks Network Trust w/ Malcolm Stagg, Synack Red Team

In this episode of the We're In Podcast, host Ryan Rutan Synack's Sr Director of Community sits down with independent security researcher and Synack Red Team member Malcolm Stagg. Malcolm breaks down his origin story-from software engineering at Microsoft and DARPA hardware challenges to discovering NATJack, a novel class of network address translation (NAT) manipulation attacks. Learn how attackers can hijack DNS and TCP sessions, bypass container isolation, and exploit Linux Netfilter flaws-plus practical mitigations you can implement today. Learn more about NATJack mitigations & research: https://natjack.io Join the Synack Red Team: https://www.synack.com/red-team/ Chapters: 00:00 - Introduction: Welcome to the We're In Podcast 02:27 - Breaking Hardware: The DARPA SSITH Challenge 06:02 - AI in Cybersecurity: Promise, Limits, and Triage Fatigue 08:44 - Introducing NATJack: Exploit Assumptions in NAT Tables 17:20 - Why NAT is Everywhere: Hypervisors, Containers, & Cloud 22:29 - Extending Attacks to TCP Connections & Session Hijacking 27:25 - DoS & Port-Scanning Vectors via Router Assignment Habits 30:39 - The Limits of Modern Infrastructure 34:34 - How to Mitigate NATJack: Strong Encryption, RPF, & Sockets 37:48 - Where to Learn More & Closing Remarks Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.