Story image

Updated: Cyber attackers flood memcached servers with amplified DDoS attacks

02 Mar 2018

Misconfigured memcached servers on internet data center (IDC) networks are being increasingly abused to conduct amplification attacks around the globe, with many vulnerable servers across Asia Pacific, Europe and North America.

Security teams at Cloudflare, Qihoo and Arbor Networks picked up the increase in attacks using the memcached protocol, which are originating from UDDP port 11211.

On March 2, Akamai detected a 1.3Tbps DDoS attack against one of its customers as a result of memcached reflections - the largest the company has ever seen.

Arbor Networks defines memcached as an in-memory database caching system often deployed in IDC, cloud and Infrastructure-as-a-Service networks to improve performance of database-driven websites and other internet services.

Ideally memcached should not be exposed to public internet but there are many deployments that leave the systems open and with the default insecure configuration.

The attacks use the misconfigured servers to launch high-volume UDP reflection-amplification attacks. It does this by spoofing an IP and sending thousands of requests to a server. That host server cannot handle the requests and the process often crashes the server itself.

Those attacks are getting bigger, according to Arbor Networks, which says there has been in increased in memcached attacks, some reaching as much as 500gb/sec and larger.

“Amplification attacks are effective, because often the response packets are much larger than the request packets. A carefully prepared technique allows an attacker with limited IP spoofing capacity (such as 1Gbps) to launch very large attacks (reaching 100s Gbps) "amplifying" the attacker's bandwidth,” Cloudflare explains further.

In some cases, a request of just 15 bytes triggered a response of 750kB – an amplification of 51,000 times.

Cloudflare has registered 260Gbps of inbound UDP memcached traffic, a figure the company describes as a ‘massive’ amplification vector.

Arbor believes that while memcached attacks may have been the work of skilled hackers in the past, they have now been weaponised and made available through the use of DDoS for hire botnets so attackers of all skill levels can now take advantage.

“Due to the nature of both the memcached service/protocol implementation as well as the prevalence and high bandwidth typically available to memcached reflectors/amplifiers, it is critical that network operators take proactive measures to ensure they are prepared to detect, classify, traceback, and mitigate these attacks, as well as ensure that any memcached installations on their networks and/or networks of their end-customers cannot be exploited as reflectors/amplifiers,” Arbor explains.

Cloudflare warns developers to stop using UDP. If there is a need for it, developers should not enable UDP be default. System administrators should ensure memcached servers are firewalled from the internet.

Cloudflare is also calling on internet service providers to help track attackers by finding out where the queries came from.

Akamai says it is working with peers and industry partners to help organisations use Best Common Practices and memcached remediation to reduce the risk to the internet.

Orange Belgium opens 1,000 sqm Antwerp data centre
It consists of more than 500 high-density 52 unit racks, installed on the equivalent of 12 tennis courts.
Time to build tech on the automobile, not the horse and cart
Nutanix’s Jeff Smith believes one of the core problems of businesses struggling to digitally ‘transform’ lies in the infrastructure they use, the data centre.
Cloud providers increasingly jumping into gaming market
Aa number of major cloud service providers are uniquely placed to capitalise on the lucrative cloud gaming market.
Intel building US’s first exascale supercomputer
Intel and the Department of Energy are building potentially the world’s first exascale supercomputer, capable of a quintillion calculations per second.
NVIDIA announces enterprise servers optimised for data science
“The rapid adoption of T4 on the world’s most popular business servers signals the start of a new era in enterprise computing."
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Storage is all the rage, and SmartNICs are the key
Mellanox’s Kevin Deierling shares the results from a new survey that identifies the key role of the network in boosting data centre performance.
Opinion: Moving applications between cloud and data centre
OpsRamp's Bhanu Singh discusses the process of moving legacy systems and applications to the cloud, as well as pitfalls to avoid.