{"id":1733,"date":"2025-01-20T21:48:10","date_gmt":"2025-01-20T21:48:10","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/2025\/01\/20\/4-2m-hosts-exposed-unsecured-tunneling-protocols\/"},"modified":"2025-01-20T21:48:11","modified_gmt":"2025-01-20T21:48:11","slug":"4-2m-hosts-exposed-unsecured-tunneling-protocols","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/4-2m-hosts-exposed-unsecured-tunneling-protocols\/","title":{"rendered":"4.2M Hosts Exposed: Unsecured Tunneling Protocols"},"content":{"rendered":"\n<\/p>\n

Tunneling Protocols Security Vulnerabilities<\/h1>\n

Introduction<\/h2>\n

New research has uncovered security vulnerabilities in multiple tunneling protocols that could allow attackers to perform a wide range of attacks. These vulnerabilities can be exploited to create one-way proxies, spoof source IPv4\/6 addresses, and conduct denial-of-service (DoS) attacks.<\/p>\n

The Vulnerabilities<\/h2>\n

The vulnerabilities are rooted in the fact that the tunneling protocols such as IP6IP6, GRE6, 4in6, and 6in4, which are mainly used to facilitate data transfers between two disconnected networks, do not authenticate and encrypt traffic without adequate security protocols like Internet Protocol Security (IPsec).<\/p>\n

Affected Hosts<\/h2>\n

As many as 4.2 million hosts have been found susceptible to the attacks, including VPN servers, ISP home routers, core internet routers, mobile network gateways, and content delivery network (CDN) nodes. China, France, Japan, the U.S., and Brazil top the list of the most affected countries.<\/p>\n

Impact of the Vulnerabilities<\/h2>\n

Successful exploitation of the shortcomings could permit an adversary to abuse a susceptible system as one-way proxies, as well as conduct denial-of-service (DoS) attacks. The impact on victims of these DoS attacks can include network congestion, service disruption as resources are consumed by the traffic overload, and crashing of overloaded network devices.<\/p>\n

Exploitation of the Vulnerabilities<\/h2>\n

An attacker simply needs to send a packet encapsulated using one of the affected protocols with two IP headers. The outer header contains the attacker’s source IP with the vulnerable host’s IP as the destination. The inner header’s source IP is that of the vulnerable host IP rather than the attacker. The destination IP is that of the target of the anonymous attack.<\/p>\n

Defenses<\/h2>\n

To prevent these vulnerabilities, it is recommended to use IPSec or WireGuard to provide authentication and encryption, and only accept tunneling packets from trusted sources. At the network level, it is also advised to implement traffic filtering on routers and middleboxes, carry out Deep packet inspection (DPI), and block all unencrypted tunneling packets.<\/p>\n

Conclusion<\/h2>\n

The vulnerabilities in tunneling protocols can have significant consequences, including network congestion, service disruption, and crashing of overloaded network devices. It is essential to take proactive measures to prevent these vulnerabilities and protect against potential attacks.<\/p>\n

CVE Identifiers<\/h3>\n

The vulnerabilities have been assigned the following CVE identifiers for the protocols in question:<\/p>\n