In November 2017, researchers have found a new class of amplification DDoS attacks: memcached amplification. At the end of February 2018 those attacks are in the wild, with a bandwidth already close to 0,5 Gbps. This lightning talk is a short analysis of the threat structure, consequences and possible ways to mitigate the threat.

1. Memcached amplification
Artyom Gavrichenkov <ag@qrator.net>

2. 2
300 Mbps
30 Gbps
Typical amplification attack
A vulnerable server
• Most servers on the
Internet send more
data to a client than
they receive
• UDP-based servers
generally do not
verify the source IP
address
• This allows for
amplification DDoS

3. • NTP
• DNS
• SNMP
• SSDP
• ICMP
• NetBIOS
3
• RIPv1
• PORTMAP
• CHARGEN
• QOTD
• Quake
• …
Vulnerable protocols

4. Vulnerable servers

5. Amplification factor
0
200
400
600
NTP
CharGEN
QotD
RIPv1
Quake
LDAP
SSDP

6. memcached
•A fast in-memory cache
•Heavily used in Web development

7. memcached
•A fast in-memory cache
•Heavily used in Web development
•Listens on all interfaces, port 11211, by default

8. memcached
•Basic ASCII protocol doesn’t do authentication
•2014, Blackhat USA:
“An attacker can inject arbitrary data into memory”

9. memcached
•Basic ASCII protocol doesn’t do authentication
•2014, Blackhat USA:
“An attacker can inject arbitrary data into memory”
•2017, Power of Community:
“An attacker can send data from memory
to a third party via spoofing victim’s IP address”

10. import memcache
m = memcache.Client([
‘reflector.example.com:11211’
])
m.set(’a’, value)
– to inject a value of an
arbitrary size under key “a”

11. print ’0x01000x0100gets arn’
– to retrieve a value

12. print ’0x01000x0100gets a a a a arn’
– to retrieve a value 5 times

13. print ’0x01000x0100gets a a a a arn’
– to retrieve a value 5 times.
Or 10 times.
Or a hundred.

14. memcached
•Theoretical amplification factor is millions

15. memcached
•Theoretical amplification factor is billions
•Fortunately, all the packets aren’t sent at once
•In practice, the amplification factor is 9000-10000
•Still 20 times the NTP Amplification does.
•Current incidents range between 200 and 500 Gbps
•Up to 1,5 Tbps can be expected

16. Mitigation
•Again, BCP 38.
•Make sure you don’t have
open memcached port 11211/udp on your network
•Use firewalls or FlowSpec to filter 11211/udp

17. Mitigation
•Again, BCP 38.
•Make sure you don’t have
open memcached port 11211/udp on your network
•Use firewalls or FlowSpec to filter 11211/udp
•More news as events warrant

18. Q&A
mailto: Artyom Gavrichenkov <ag@qrator.net>
https://medium.com/@qratorlabs/