Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Organizations Warned: STUN Servers Increasingly Abused for DDoS Attacks

Application and network performance management company NETSCOUT warned organizations this week that STUN servers have been increasingly abused for distributed denial-of-service (DDoS) attacks, and there are tens of thousands of servers that could be abused for such attacks by malicious actors.

Application and network performance management company NETSCOUT warned organizations this week that STUN servers have been increasingly abused for distributed denial-of-service (DDoS) attacks, and there are tens of thousands of servers that could be abused for such attacks by malicious actors.

The Session Traversal Utilities for NAT (STUN) protocol serves as a tool for other protocols in dealing with Network Address Translator (NAT) traversal, helping applications discover the NATs and firewalls that are between them and the Internet. It also enables applications to determine the public IP allocated to them by the NAT.

According to NETSCOUT, threat actors have been adding STUN reflection/amplification to DDoS-for-hire services.

While the amplification rate is only 2.32 to 1, UDP reflection/amplification attacks abusing STUN services can be more difficult to mitigate without overblocking legitimate traffic. NETSCOUT discovered more than 75,000 STUN servers that could be abused for DDoS attacks and the company has seen significant multi-vector attacks that include STUN as a component.

“Observed attack bandwidth (bps) sizes range from ~15 Gbps to ~60 Gbps for single-vector STUN reflection/amplification attacks and up to an aggregate 2 Tbps for multivector attacks that include STUN as a component,” NETSCOUT said.

“The highest observed throughput (pps) for a single-vector STUN reflection/amplification attack is ~6 Mpps and up to an aggregate ~836.3 Mpps for multivector attacks that include STUN as a component,” it added.

The company pointed out that the organizations whose STUN servers are abused in these DDoS attacks can also experience disruptions.

NETSCOUT has provided a series of recommendations for network operators and other organizations on preventing and mitigating DDoS attacks that leverage STUN.

Related: Thousands of Unprotected RDP Servers Can Be Abused for DDoS Attacks

Related: Plex Media Server Abused for DDoS Attacks

Related: Attackers Use CoAP for DDoS Amplification

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...