Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Malware Trending: STUN Awareness

Summary: Unit 42 examined Palo Alto Networks WildFire data and found malware families using the STUN protocol, which lets a host behind NAT learn its public IP address, a technique first flagged in a Stop Malvertising report on the Dyreza banking trojan, which also fell back to icanhazip.com if STUN failed. On an extended STUN server list, stun.qvod.com accounted for 4,705 samples (75%) and stun.qq.com for 489 (8%), with QVOD traffic dropping sharply around April 2014, which researchers correlate with the QVOD service's shutdown over piracy concerns, while Dyreza-associated STUN usage rose from around July 2014.

What you should know: Two STUN servers, stun.qvod.com and stun.qq.com, carried roughly 83% of the malicious STUN traffic WildFire observed, and STUN's weakness under symmetric NAT, common in large businesses, is why attackers add fallback methods to widen the target space.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related