Internet2 Network Security SIG

["Spurling, Shannon" <>]

You'r a couple hours late. Just saw it generate in excess of 40Gbps in a series of 2 consecutive 15 minute events aginst a single ip/site security apppliance earlier this afternoon. It was ugly. Haven't seen something of that scale in a couple of years.

Sent via the Samsung Galaxy S® 6, an AT&T 4G LTE smartphone

-------- Original message --------

From: Karl Newell <>

Date: 2/27/18 8:43 PM (GMT-06:00)

To:

Subject: [Security-WG] New DDoS amplification attack - memcached

Hey all,

 

Be on the lookout for a new DDoS amplification attack leveraging memcached.  Reports indicate an amplification factor as high as 51,000.

 

https://www.arbornetworks.com/blog/asert/memcached-reflection-amplification-description-ddos-attack-mitigation-recommendations/

https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/

 

Check your flows for UDP/11211.  Attack traffic will be sourced from that port while traffic destined to that port (and TCP/11211) may indicate you are being used to launch attacks.  In most (dare I say all?) scenarios, memcached does not need to be publicly accessible so get it firewalled and/or disable UDP.

 

Please share any updates if you see attacks.

 

Cheers,

Karl