An interesting thing is happening around the Internet in the past week with a new type of Distributed Denial of Service(DDoS) attack. Once such attack sent 1.35 terabits of data per second to GitHub taking the site down for five minutes before being mitigated. These attacks are a bit different from the past where compromised systems were aggregated into Botnets to send large amounts of traffic to a victim. They only need one server – an improperly configured Memcached.
These attacks known as “Amplification Attacks” are relatively easy to execute with a few simple command line tools. Consider this example:
In less than ½ second we were able to generate 1117 bytes of UDP traffic from a single 16-byte request. Scripting with a loop and you can see the power of such an attack. UDP is perfect for these types of attacks as its design does not check the validity of packets. Therefore, manipulating the source headers of the requests with a victims IP sends the large reflective payloads back to them.
As easy as these attacks are to pull off, they are just as easy to protect against. Simply ensure that the Memcached server is not directly on the Internet listening on port 11211. It should be behind a firewall. Better yet, alter the default configuration to start with TCP only by using the “-U 0” option, this will disable UDP support.
For More Information: https://www.wired.com/story/github-ddos-memcached/
Share on
