Lost in Encapsulation: Exploiting Open Tunnelling Hosts and Attacking Private Networks

Tunnelling protocols form an essential backbone of today's Internet, where they primarily interconnect remote networks. However, many tunnelling hosts do not implement authentication, making them behave as open one-way proxies and, in turn, introducing denial-of-service (DoS) risks.

In this paper, we show that the security risk of open tunnelling hosts extends beyond DoS attacks. First, we study NAT-enabled tunnelling hosts and demonstrate a novel attack that manipulates the NAT's TCP state, enabling an attacker to fingerprint and inject traffic into the co-located private network. We also study tunnelling hosts that translate global IP addresses, and turn them into two-way proxies. We demonstrate how these two-way proxies enable an attacker to: (1) spoof TCP connections; and (2) launch a novel loop DoS attack. Additionally, we show that Layer 2 (L2) tunnelling hosts, specifically GRETAP, can be abused to attack the LAN, and we demonstrate the impact with 5 attacks: leaking the host's global and private MAC addresses, DHCP starvation, DNS poisoning, ARP spoofing, and an infinite loop DoS attack.

To evaluate the prevalence of vulnerable hosts, we conduct 9 Internet-wide scans and identify that 438,280 hosts are potentially vulnerable. Overall, we show that open tunnelling protocols enable new attacks on co-located private networks, and we hope our work encourages the adoption of new defences.