This article is more than 1 year old
World's biggest DDoS attack record broken after just five days
Memcached attacks are going to be this year's thing
Last week, the code repository GitHub was taken off air in a 1.3Tbps denial of service attack. We predicted then that there would be more such attacks and it seems we were right.
Arbor Networks is now reporting that a US service provider suffered a 1.7Tbps attack earlier this month. In this case, there were no outages as the provider had taken adequate safeguards, but it's clear that the memcached attack is going to be a feature network managers are going to have to take seriously in the future.
Time to batten down the hatches
The attacks use shoddily secured memcached database servers to amplify attacks against a target. The assailant spoofs the UDP address of its victim and pings a small data packet at a memcached server that doesn't have an authenticated traffic requirement in place. The server responds by firing back as much as 50,000 times the data it received.
With multiple data packets sent out a second, the memcached server unwittingly amplifies the deluge of data that can be sent against the target. Without proper filtering and network management, the tsunami of data can be enough to knock some providers offline.
There are some simple mitigation techniques, notably blocking off UDP traffic from Port 11211, which is the default avenue for traffic from memcached servers. In addition, the operators of memcached servers need to lock down their systems to avoid taking part in such denial of service attacks.
"While the internet community is coming together to shut down access to the many open memcached servers out there, the sheer number of servers running memcached openly will make this a lasting vulnerability that attackers will exploit," said Carlos Morales, VP of sales, engineering and operations at Arbor Networks.
"It is critically important for companies to take the necessary steps to protect themselves."
It has been nearly five years since the first memcached attacks were reported, but in the last few weeks they have grown in popularity, and even include ransoms. It's clear these are going to be a feature unless memcached server operators get their act together. ®
Biting the hand that feeds IT
