Internet2 Network Security SIG

[Karl Newell <>]

FYI, perfsonar uses memcached and is listening on UDP/11211.  The default PS toolkit firewall rules block public access to the port but you should confirm (we’ve found one vulnerable perfsonar node already).

 

An update from the perfsonar team:

https://lists.internet2.edu/sympa/arc/perfsonar-announce/2018-03/msg00000.html

 

Cheers,

Karl

 

From: <> on behalf of Karl Newell <>
Reply-To: "" <>
Date: Tuesday, February 27, 2018 at 7:43 PM
To: "" <>
Subject: [Security-WG] New DDoS amplification attack - memcached

 

Hey all,

 

Be on the lookout for a new DDoS amplification attack leveraging memcached.  Reports indicate an amplification factor as high as 51,000.

 

https://www.arbornetworks.com/blog/asert/memcached-reflection-amplification-description-ddos-attack-mitigation-recommendations/

https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/

 

Check your flows for UDP/11211.  Attack traffic will be sourced from that port while traffic destined to that port (and TCP/11211) may indicate you are being used to launch attacks.  In most (dare I say all?) scenarios, memcached does not need to be publicly accessible so get it firewalled and/or disable UDP.

 

Please share any updates if you see attacks.

 

Cheers,

Karl