Memcached Amplification DDoS: A 2018 Threat (APRICOT 2018)

In November 2017, researchers have found a new class of amplification DDoS attacks: memcached amplification. At the end of February 2018 those attacks are in the wild, with a bandwidth already close to 0,5 Gbps.

This lightning talk is a short analysis of the threat structure, consequences and possible ways to mitigate the threat.

Transcript

1. Memcached amplification Artyom Gavrichenkov <ag@qrator.net>
2. 2 300 Mbps 30 Gbps Typical amplification attack A vulnerable server • Most servers on the Internet send more data to a client than they receive • UDP-based servers generally do not verify the source IP address • This allows for amplification DDoS
3. • NTP • DNS • SNMP • SSDP • ICMP • NetBIOS 3 • RIPv1 • PORTMAP • CHARGEN • QOTD • Quake • … Vulnerable protocols
4. Vulnerable servers
5. Amplification factor 0 200 400 600 NTP CharGEN QotD RIPv1 Quake LDAP SSDP
6. memcached •A fast in-memory cache •Heavily used in Web development
7. memcached •A fast in-memory cache •Heavily used in Web development •Listens on all interfaces, port 11211, by default
8. memcached •Basic ASCII protocol doesn’t do authentication •2014, Blackhat USA: “An attacker can inject arbitrary data into memory”
9. memcached •Basic ASCII protocol doesn’t do authentication •2014, Blackhat USA: “An attacker can inject arbitrary data into memory” •2017, Power of Community: “An attacker can send data from memory to a third party via spoofing victim’s IP address”
10. import memcache m = memcache.Client([ ‘reflector.example.com:11211’ ]) m.set(’a’, value) – to inject a value of an arbitrary size under key “a”
11. print ’\0\x01\0\0\0\x01\0\0gets a\r\n’ – to retrieve a value
12. print ’\0\x01\0\0\0\x01\0\0gets a a a a a\r\n’ – to retrieve a value 5 times
13. print ’\0\x01\0\0\0\x01\0\0gets a a a a a\r\n’ – to retrieve a value 5 times. Or 10 times. Or a hundred.
14. memcached •Theoretical amplification factor is millions
15. memcached •Theoretical amplification factor is billions •Fortunately, all the packets aren’t sent at once •In practice, the amplification factor is 9000-10000 •Still 20 times the NTP Amplification does. •Current incidents range between 200 and 500 Gbps •Up to 1,5 Tbps can be expected
16. Mitigation •Again, BCP 38. •Make sure you don’t have open memcached port 11211/udp on your network •Use firewalls or FlowSpec to filter 11211/udp
17. Mitigation •Again, BCP 38. •Make sure you don’t have open memcached port 11211/udp on your network •Use firewalls or FlowSpec to filter 11211/udp •More news as events warrant
18. Q&A mailto: Artyom Gavrichenkov <ag@qrator.net> https://medium.com/@qratorlabs/