Story image

Updated: Cyber attackers flood memcached servers with amplified DDoS attacks

02 Mar 18

Misconfigured memcached servers on internet data center (IDC) networks are being increasingly abused to conduct amplification attacks around the globe, with many vulnerable servers across Asia Pacific, Europe and North America.

Security teams at Cloudflare, Qihoo and Arbor Networks picked up the increase in attacks using the memcached protocol, which are originating from UDDP port 11211.

On March 2, Akamai detected a 1.3Tbps DDoS attack against one of its customers as a result of memcached reflections - the largest the company has ever seen.

Arbor Networks defines memcached as an in-memory database caching system often deployed in IDC, cloud and Infrastructure-as-a-Service networks to improve performance of database-driven websites and other internet services.

Ideally memcached should not be exposed to public internet but there are many deployments that leave the systems open and with the default insecure configuration.

The attacks use the misconfigured servers to launch high-volume UDP reflection-amplification attacks. It does this by spoofing an IP and sending thousands of requests to a server. That host server cannot handle the requests and the process often crashes the server itself.

Those attacks are getting bigger, according to Arbor Networks, which says there has been in increased in memcached attacks, some reaching as much as 500gb/sec and larger.

“Amplification attacks are effective, because often the response packets are much larger than the request packets. A carefully prepared technique allows an attacker with limited IP spoofing capacity (such as 1Gbps) to launch very large attacks (reaching 100s Gbps) "amplifying" the attacker's bandwidth,” Cloudflare explains further.

In some cases, a request of just 15 bytes triggered a response of 750kB – an amplification of 51,000 times.

Cloudflare has registered 260Gbps of inbound UDP memcached traffic, a figure the company describes as a ‘massive’ amplification vector.

Arbor believes that while memcached attacks may have been the work of skilled hackers in the past, they have now been weaponised and made available through the use of DDoS for hire botnets so attackers of all skill levels can now take advantage.

“Due to the nature of both the memcached service/protocol implementation as well as the prevalence and high bandwidth typically available to memcached reflectors/amplifiers, it is critical that network operators take proactive measures to ensure they are prepared to detect, classify, traceback, and mitigate these attacks, as well as ensure that any memcached installations on their networks and/or networks of their end-customers cannot be exploited as reflectors/amplifiers,” Arbor explains.

Cloudflare warns developers to stop using UDP. If there is a need for it, developers should not enable UDP be default. System administrators should ensure memcached servers are firewalled from the internet.

Cloudflare is also calling on internet service providers to help track attackers by finding out where the queries came from.

Akamai says it is working with peers and industry partners to help organisations use Best Common Practices and memcached remediation to reduce the risk to the internet.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.