Application and network performance management company NETSCOUT warned organizations this week that STUN servers have been increasingly abused for distributed denial-of-service (DDoS) attacks, and there are tens of thousands of servers that could be abused for such attacks by malicious actors.
The Session Traversal Utilities for NAT (STUN) protocol serves as a tool for other protocols in dealing with Network Address Translator (NAT) traversal, helping applications discover the NATs and firewalls that are between them and the Internet. It also enables applications to determine the public IP allocated to them by the NAT.
According to NETSCOUT, threat actors have been adding STUN reflection/amplification to DDoS-for-hire services.
While the amplification rate is only 2.32 to 1, UDP reflection/amplification attacks abusing STUN services can be more difficult to mitigate without overblocking legitimate traffic. NETSCOUT discovered more than 75,000 STUN servers that could be abused for DDoS attacks and the company has seen significant multi-vector attacks that include STUN as a component.
“Observed attack bandwidth (bps) sizes range from ~15 Gbps to ~60 Gbps for single-vector STUN reflection/amplification attacks and up to an aggregate 2 Tbps for multivector attacks that include STUN as a component,” NETSCOUT said.
“The highest observed throughput (pps) for a single-vector STUN reflection/amplification attack is ~6 Mpps and up to an aggregate ~836.3 Mpps for multivector attacks that include STUN as a component,” it added.
The company pointed out that the organizations whose STUN servers are abused in these DDoS attacks can also experience disruptions.
NETSCOUT has provided a series of recommendations for network operators and other organizations on preventing and mitigating DDoS attacks that leverage STUN.
Related: Thousands of Unprotected RDP Servers Can Be Abused for DDoS Attacks
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
- UK Gov Warns of Phishing Attacks Launched by Iranian, Russian Cyberspies
- Dozens of Cybersecurity Companies Announced Layoffs in Past Year
- Security Update for Chrome 109 Patches 6 Vulnerabilities
- New Open Source OT Security Tool Helps Address Impact of Upcoming Microsoft Patch
- Forward Networks Raises $50 Million in Series D Funding
Latest News
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Cyberattacks Target Websites of German Airports, Admin
- US Infiltrates Big Ransomware Gang: ‘We Hacked the Hackers’
- Tenable Launches $25 Million Early-Stage Venture Fund
