Haunted by Legacy: Discovering and Exploiting Vulnerable Tunnelling Hosts#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025
Angelos Beitis and Mathy Vanhoef, DistriNet, KU Leuven — Core
- Why: The same tunneling encapsulation families underlying datacenter and WAN overlay networking — GRE, IPIP, and IPv4/IPv6 translation tunnels — turn out to have over 4 million open, unauthenticated hosts on the public Internet, directly relevant to anyone running or securing tunnel endpoints.
- What: An Internet-wide scan finding 4M+ hosts that accept unauthenticated IPIP, GRE, 4in6, or 6in4 tunneling traffic, exploitable as one-way proxies, for source-address spoofing, or for access into private networks — plus two new amplification-based DoS attacks (16x and 75x amplification) and an Economic DoS attack that drains a host's outgoing bandwidth. (from abstract only)
- How: Seven distinct IPv4/IPv6 scan methods identify hosts accepting unauthenticated tunneling traffic; the amplification attacks work by concentrating traffic in time or looping packets between vulnerable hosts. (from abstract only)
- Where applicable: General for any network exposing GRE/IPIP/4in6/6in4 tunnel endpoints to the Internet without authentication — directly applicable to DC/WAN overlay and legacy IPv6-transition tunnel deployments specifically, not just an academic curiosity.