Memcached Amplification DDoS: A 2018 Threat (APRICOT 2018)

In November 2017, researchers have found a new class of amplification DDoS attacks: memcached amplification. At the end of February 2018 those attacks are in the wild, with a bandwidth already close to 0,5 Gbps.

This lightning talk is a short analysis of the threat structure, consequences and possible ways to mitigate the threat.

Transcript

1. Memcached amplification
   Artyom Gavrichenkov
   

   View Slide

2. 2
   300 Mbps
   30 Gbps
   Typical amplification attack
   A vulnerable server
   • Most servers on the
   Internet send more
   data to a client than
   they receive
   • UDP-based servers
   generally do not
   verify the source IP
   address
   • This allows for
   amplification DDoS
   

   View Slide

3. • NTP
   • DNS
   • SNMP
   • SSDP
   • ICMP
   • NetBIOS
   3
   • RIPv1
   • PORTMAP
   • CHARGEN
   • QOTD
   • Quake
   • …
   Vulnerable protocols
   

   View Slide

4. Vulnerable servers
   

   View Slide

5. Amplification factor
   0
   200
   400
   600
   NTP
   CharGEN
   QotD
   RIPv1
   Quake
   LDAP
   SSDP
   

   View Slide

6. memcached
   •A fast in-memory cache
   •Heavily used in Web development
   

   View Slide

7. memcached
   •A fast in-memory cache
   •Heavily used in Web development
   •Listens on all interfaces, port 11211, by default
   

   View Slide

8. memcached
   •Basic ASCII protocol doesn’t do authentication
   •2014, Blackhat USA:
   “An attacker can inject arbitrary data into memory”
   

   View Slide

9. memcached
   •Basic ASCII protocol doesn’t do authentication
   •2014, Blackhat USA:
   “An attacker can inject arbitrary data into memory”
   •2017, Power of Community:
   “An attacker can send data from memory
   to a third party via spoofing victim’s IP address”
   

   View Slide

10. import memcache
    m = memcache.Client([
    ‘reflector.example.com:11211’
    ])
    m.set(’a’, value)
    – to inject a value of an
    arbitrary size under key “a”
    

    View Slide

11. print ’\0\x01\0\0\0\x01\0\0gets a\r\n’
    – to retrieve a value
    

    View Slide

12. print ’\0\x01\0\0\0\x01\0\0gets a a a a a\r\n’
    – to retrieve a value 5 times
    

    View Slide

13. print ’\0\x01\0\0\0\x01\0\0gets a a a a a\r\n’
    – to retrieve a value 5 times.
    Or 10 times.
    Or a hundred.
    

    View Slide

14. memcached
    •Theoretical amplification factor is millions
    

    View Slide

15. memcached
    •Theoretical amplification factor is billions
    •Fortunately, all the packets aren’t sent at once
    •In practice, the amplification factor is 9000-10000
    •Still 20 times the NTP Amplification does.
    •Current incidents range between 200 and 500 Gbps
    •Up to 1,5 Tbps can be expected
    

    View Slide

16. Mitigation
    •Again, BCP 38.
    •Make sure you don’t have
    open memcached port 11211/udp on your network
    •Use firewalls or FlowSpec to filter 11211/udp
    

    View Slide

17. Mitigation
    •Again, BCP 38.
    •Make sure you don’t have
    open memcached port 11211/udp on your network
    •Use firewalls or FlowSpec to filter 11211/udp
    •More news as events warrant
    

    View Slide

18. Q&A
    mailto: Artyom Gavrichenkov
    https://medium.com/@qratorlabs/
    

    View Slide