Security News > 2021 > June > Organizations Warned: STUN Servers Increasingly Abused for DDoS Attacks

Application and network performance management company NETSCOUT warned organizations this week that STUN servers have been increasingly abused for distributed denial-of-service attacks, and there are tens of thousands of servers that could be abused for such attacks by malicious actors.

While the amplification rate is only 2.32 to 1, UDP reflection/amplification attacks abusing STUN services can be more difficult to mitigate without overblocking legitimate traffic.

NETSCOUT discovered more than 75,000 STUN servers that could be abused for DDoS attacks and the company has seen significant multi-vector attacks that include STUN as a component.

"Observed attack bandwidth sizes range from ~15 Gbps to ~60 Gbps for single-vector STUN reflection/amplification attacks and up to an aggregate 2 Tbps for multivector attacks that include STUN as a component," NETSCOUT said.

"The highest observed throughput for a single-vector STUN reflection/amplification attack is ~6 Mpps and up to an aggregate ~836.3 Mpps for multivector attacks that include STUN as a component," it added.

The company pointed out that the organizations whose STUN servers are abused in these DDoS attacks can also experience disruptions.

News URL

http://feedproxy.google.com/~r/securityweek/~3/lpArT9VCMqE/organizations-warned-stun-servers-increasingly-abused-ddos-attacks