Researchers at Leuven University (KU Leuven) have discovered the existence of millions of poorly secured so-called ‘tunnelling hosts’. Tunnelling hosts are servers or computers that act as intermediaries to connect computer networks. A total of more than four million vulnerable tunnelling hosts were found.
Leuven University team exposes security leak affecting millions of computer servers
Published:
Researchers at KU Leuven's DistriNet Research Group sent harmless, test packs containing data to millions of devices around the world. They then checked whether the data packs passed through the server or not. The packs used a tunnelling protocol, a particular way of packaging data.
Professor Mathy Vanhoef told VRT News that "Commonly used protocols are IP in IP and GRE (Generic Routing Encapsulation), but these protocols do not allow encryption or sender control. For that, additional security called Internet Protocol Security must be used and this is precisely where the problem lies here as this is often omitted. In total, we found more than 3.5 million vulnerable hosts using IPv4 addresses as well as more than 700,000 using the newer IPv6 addresses."
Vulnerable IT infrastructure was found the world over. However, it was found more frequently in China, France, Japan, United and Brazil than in other countries. Among the servers found to be vulnerable were servers operated by large companies such as China Mobile or Softbank. In France, thousands of home routers of one of the country’s internet service providers were found to be affected. In Flanders, many Telenet internet customers were also found to be vulnerable. All those found to be affected have been warned in the meantime and host servers have been made more secure.