Tunnelpocalypse

In this network security presentation from the DEF CON 33 Community Stage, DDoS mitigation engineer Rich presents "Tunnelpocalypse," an investigation into protocol encapsulation vulnerabilities that threaten modern internet routing. Opening at 00:00, Rich describes the operational hazards of handling massive volumetric denial-of-service attacks across high-speed enterprise networks.

At 05:01, he dives into the core vulnerability: unvalidated IP-in-IP, GRE, and IPv6 tunneling configurations on core transit routers. He demonstrates how remote adversaries forge outer packet headers, allowing spoofed packets to slip past edge firewall rules and terminate directly inside protected network segments. At 10:02, he references global telemetry gathered in collaboration with The Shadowserver Foundation, illustrating widespread router exposure across global transit providers.

At 15:00, Rich demonstrates packet reflection and amplification attacks enabled by misconfigured tunnel endpoints. He closes at 20:02 by urging network operators to implement rigorous edge Access Control Lists (ACLs), enforce BCP 38 / RFC 2827 ingress source address filtering, and patch routing firmware to ensure encapsulated traffic cannot bypass perimeter security boundaries. (AI summary — Gemini Flash)