The 4 million vulnerable hosts they discovered accept unauthenticated IP in IP (IPIP), Generic Routing Encapsulation (GRE), ...