Application and network performance management company NETSCOUT warned organizations this week that STUN servers have been increasingly abused for distributed denial-of-service (DDoS) attacks, and there are tens of thousands of servers that could be abused for such attacks by malicious actors.
The Session Traversal Utilities for NAT (STUN) protocol serves as a tool for other protocols in dealing with Network Address Translator (NAT) traversal, helping applications discover the NATs and firewalls that are between them and the Internet. It also enables applications to determine the public IP allocated to them by the NAT.
According to NETSCOUT, threat actors have been adding STUN reflection/amplification to DDoS-for-hire services.
While the amplification rate is only 2.32 to 1, UDP reflection/amplification attacks abusing STUN services can be more difficult to mitigate without overblocking legitimate traffic. NETSCOUT discovered more than 75,000 STUN servers that could be abused for DDoS attacks and the company has seen significant multi-vector attacks that include STUN as a component.
“Observed attack bandwidth (bps) sizes range from ~15 Gbps to ~60 Gbps for single-vector STUN reflection/amplification attacks and up to an aggregate 2 Tbps for multivector attacks that include STUN as a component,” NETSCOUT said.
“The highest observed throughput (pps) for a single-vector STUN reflection/amplification attack is ~6 Mpps and up to an aggregate ~836.3 Mpps for multivector attacks that include STUN as a component,” it added.
The company pointed out that the organizations whose STUN servers are abused in these DDoS attacks can also experience disruptions.
NETSCOUT has provided a series of recommendations for network operators and other organizations on preventing and mitigating DDoS attacks that leverage STUN.
Related: Thousands of Unprotected RDP Servers Can Be Abused for DDoS Attacks
