[tram] stun amplification vulnerability

[Mészáros Mihály <[e-mail]>]

Hi,

I experienced, that STUN binding requests(udp) came from spoofed/strange
source addresses (from e.g. zoom,valve, etc. address range) to our STUN
servers.

I don't have better explanation for that, probably someone is using our
STUN server responses to attack the spoofed source IPs.

If a STUN server is responding to a binding request it may sends many
attributes(RFC5780 attributes and (for classical backward compatibility)
mapped address, software, fingerprint,  etc.),
this way the request/response gain factor could be ~3x.

STUN should not authenticated, so the attack could be distributed to
many STUN servers easily, but even if STUN request is authenticated,
then 401 response also gives 2x times bigger response.

If STUN not authenticated, then the amount of attack traffic could be
relativity small and distributed in time  (if attack is very well
distributed to many STUN servers).
This way the attacker's traffic could be easily under the radar threshold.

Despite the gain factor 2-3x is not very big, still it seems it has
attracted someones attention.

I am wondering if it worth to add a warning to STUN Security
Consideration about it?

Implementations should consider possibility of this type of attack.
As mitigation implementation may consider to limit the STUN response
only to send one attribute "XOR-MAPPED-ADDRESS", to reduce the gain
factor as close as possible to 1x.

Thanks,
Misi