Memcache DDoS: A Little Bit More
<!--kg-card-begin: markdown--><p>This blog is a joint effort of 360 <span style="font-family:Times new roman">0</span>kee Team, 360 CERT, and 360 Netlab.</p>
<p>Memcache UDP Reflection Amplification DDoS (hereinafter referred as Memcache DRDoS) has attracted quite some attentions from security community this week. We are not going to repeat the public known facts, and this blog will only touch base with some more details,</p>
<h4 id="originaldisclosureonpoc2017meeting">Original Disclosure on POC 2017 Meeting</h4>
<p>Memcache DRDoS, was first disclosed around 2017-06, by <span style="font-family:Times new roman">0</span>kee team from our company. Here is the <a href="http://powerofcommunity.net/poc2017/shengbao.pdf">detailed document</a> first published in November 2017, at <a href="http://powerofcommunity.net/2017">PoC 2017</a> conference</p>
<p>In this document, we point out:</p>
<ul>
<li>An extremely high <strong>bandwidth amplification factor, at least 50k</strong></li>
<li>The number of potential reflection points is large, estimated <strong>around 60k utilizable memcache server in November, 2017</strong>. And these servers tend to have higher bandwidth resources</li>
</ul>
<h4 id="currenttrendsonddosmon">Current Trends on DDoSMon</h4>
<p>Since the disclosure, we have been using  <a href="https://ddosmon.net/insight">DDosMon</a> to monitor memcache DRDoS on the backbone level. In the past few months, this kind of attack is not very popular, but things have greatly changed since February 24th, 2018.</p>
<p>Just in a few days, Memcache DRDoS rise up from less than 50 events per day, up to 300~400 per day. And today's number has already reached 1484, with an hour to go. These numbers are shown in the following figure:</p>
<p><img src="__GHOST_URL__/content/images/2018/03/memcache.drdos.trend.1month-update-1.png" alt="" loading="lazy"></p>
<p>It should be noted that current Memcache DrDoS is still not the mainstream of DDoS.<br>
It accounts for less than 1% in all DRDoS, ranks after DNS, CLDAP, NTP, SSDP, CharGen, L2TP, BitTorrent, Portmap and SNMP.</p>
<p><img src="__GHOST_URL__/content/images/2018/03/memcache.drdos.trend.1month.distribution.png" alt="" loading="lazy"></p>
<h4 id="therealamplificationfactorswetestsonrealnetwork">The Real Amplification Factors We Tests on Real Network</h4>
<p>So how big the amp factor we should be expecting in real attacks? We performed some tests, as well as analyzed some real attack payloads we captured, and the following are some numbers:</p>
<ul>
<li>The amplification factor, from 1k to 60k, can be stably achieved in our testing environment</li>
<li>We reached the maximum 60k amplification factor in real network</li>
<li>These test results are consistent with those of the original <span style="font-family:Times new roman">0</span>kee team estimates, and the <a href="Https://www.us-cert.gov/ncas/alerts/TA14-017A">US-CERT Alarm</a>.</li>
<li>The maximum 60k amplification factor can not be achieved by the attack payload we have captured. Those payloads are somehow problematic, may cause the memcache server crash, so the attack cannot continue. But an easy fix will take care the bug, the attacker would be able to achieve a 60k amplification factor eventually.</li>
<li>What is more, even an amplification factor higher than 60k can be made, but we will not discuss the details here.</li>
</ul>
<h4 id="currentlyknownattackcases">Currently Known Attack Cases</h4>
<p>Akamai has just reported <a href="https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html">a DDoS attack case</a>, with the peak attack traffic at 1.3Tbps, a new Akamai record after 2016 Mirai DDoS attack against KrebsonSecuritycom.</p>
<p>On February 27, Qrator Labs reported <a href="https://medium.com/@qratorlabs/THE-MEMCACHED-AMPLIFICATION-ATTACK-REACHING-500-GBPS-B439A7B83C98">a DDoS attack case</a> on medium.com. According to the article, this attack is on UDP 11211 port, and convinced Memcache DRDoS, with the peak attack traffic as high as 480Gbps.</p>
<p>Beside these reported cases, we believe other big attacks have actually occurred but not publicly reported.</p>
<h4 id="currentcountermeasurestakenbyispsandsecuritycommunities">Current Countermeasures Taken by ISPs and Security Communities</h4>
<p>Currently, a number of related security notices have already released, part of which:</p>
<ul>
<li>Notifications: Multiple security vendors, certs have issued notices, such as <a href="https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/">CloudFlare</a>, <a href="https://medium.com/@qratorlabs/the-memcached-amplification-attack-reaching-500-gbps-b439a7b83c98">Qrator Labs</a>, <a href="https://www.arbornetworks.com/blog/asert/memcached-reflection-amplification-description-ddos-attack-mitigation-recommendations/">Arbor Networks</a>, <a href="https://www.us-cert.gov/ncas/alerts/TA14-017A">US-CERT</a>, and so on</li>
<li>Defensive Actions: Multiple ISPs, including <a href="https://mailman.nanog.org/pipermail/nanog/2018-March/094350.html">NTT</a> have placed rate limits on UDP 11211 port.</li>
</ul>
<p>At this point, we probably will start to see more bigger attacks, &quot;G era&quot; to &quot;<strong>T era of DDoS</strong>&quot; might have started.</p>
<h4 id="ourddosmonmemcachepage">Our DDosMon Memcache page</h4>
<p>When event like this happens, one of the security community needs is the visibility, we have temporally setup a webpage <a href="https://ddosmon.net/memcached_amplification_attack">here</a> on our DDosMon page to track in near real-time about the Memcache attacks, it displays the Memcache attack trend, victims and some statistic, feel free to take a look.</p>
<!--kg-card-end: markdown-->
This blog is a joint effort of 360 0kee Team, 360 CERT, and 360 Netlab.


Memcache UDP Reflection Amplification DDoS (hereinafter referred as Memcache DRDoS) has attracted quite some attentions from security community this week. We are not going to repeat the public known facts, and this blog will only touch base with some more details,


Original Disclosure on POC 2017 Meeting


Memcache DRDoS, was first disclosed around 2017-06, by 0kee team from our company. Here is the detailed document first published in November 2017, at PoC 2017 conference


In this document, we point out:


 * An extremely high bandwidth amplification factor, at least 50k
 * The number of potential reflection points is large, estimated around 60k utilizable memcache server in November, 2017. And these servers tend to have higher bandwidth resources


Current Trends on DDoSMon


Since the disclosure, we have been using DDosMon to monitor memcache DRDoS on the backbone level. In the past few months, this kind of attack is not very popular, but things have greatly changed since February 24th, 2018.


Just in a few days, Memcache DRDoS rise up from less than 50 events per day, up to 300~400 per day. And today's number has already reached 1484, with an hour to go. These numbers are shown in the following figure:





It should be noted that current Memcache DrDoS is still not the mainstream of DDoS.

It accounts for less than 1% in all DRDoS, ranks after DNS, CLDAP, NTP, SSDP, CharGen, L2TP, BitTorrent, Portmap and SNMP.





The Real Amplification Factors We Tests on Real Network


So how big the amp factor we should be expecting in real attacks? We performed some tests, as well as analyzed some real attack payloads we captured, and the following are some numbers:


 * The amplification factor, from 1k to 60k, can be stably achieved in our testing environment
 * We reached the maximum 60k amplification factor in real network
 * These test results are consistent with those of the original 0kee team estimates, and the US-CERT Alarm.
 * The maximum 60k amplification factor can not be achieved by the attack payload we have captured. Those payloads are somehow problematic, may cause the memcache server crash, so the attack cannot continue. But an easy fix will take care the bug, the attacker would be able to achieve a 60k amplification factor eventually.
 * What is more, even an amplification factor higher than 60k can be made, but we will not discuss the details here.


Currently Known Attack Cases


Akamai has just reported a DDoS attack case, with the peak attack traffic at 1.3Tbps, a new Akamai record after 2016 Mirai DDoS attack against KrebsonSecuritycom.


On February 27, Qrator Labs reported a DDoS attack case on medium.com. According to the article, this attack is on UDP 11211 port, and convinced Memcache DRDoS, with the peak attack traffic as high as 480Gbps.


Beside these reported cases, we believe other big attacks have actually occurred but not publicly reported.


Current Countermeasures Taken by ISPs and Security Communities


Currently, a number of related security notices have already released, part of which:


 * Notifications: Multiple security vendors, certs have issued notices, such as CloudFlare, Qrator Labs, Arbor Networks, US-CERT, and so on
 * Defensive Actions: Multiple ISPs, including NTT have placed rate limits on UDP 11211 port.


At this point, we probably will start to see more bigger attacks, "G era" to "T era of DDoS" might have started.


Our DDosMon Memcache page


When event like this happens, one of the security community needs is the visibility, we have temporally setup a webpage here on our DDosMon page to track in near real-time about the Memcache attacks, it displays the Memcache attack trend, victims and some statistic, feel free to take a look.

{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"This blog is a joint effort of 360 <span style=\"font-family:Times new roman\">0</span>kee Team, 360 CERT, and 360 Netlab.\n\nMemcache UDP Reflection Amplification DDoS (hereinafter referred as Memcache DRDoS) has attracted quite some attentions from security community this week. We are not going to repeat the public known facts, and this blog will only touch base with some more details,\n\n#### Original Disclosure on POC 2017 Meeting\n\nMemcache DRDoS, was first disclosed around 2017-06, by <span style=\"font-family:Times new roman\">0</span>kee team from our company. Here is the [detailed document](http://powerofcommunity.net/poc2017/shengbao.pdf) first published in November 2017, at [PoC 2017](http://powerofcommunity.net/2017) conference\n\n\nIn this document, we point out:\n\n - An extremely high **bandwidth amplification factor, at least 50k**\n - The number of potential reflection points is large, estimated **around 60k utilizable memcache server in November, 2017**. And these servers tend to have higher bandwidth resources\n\n#### Current Trends on DDoSMon\n\nSince the disclosure, we have been using  [DDosMon](https://ddosmon.net/insight) to monitor memcache DRDoS on the backbone level. In the past few months, this kind of attack is not very popular, but things have greatly changed since February 24th, 2018.\n\nJust in a few days, Memcache DRDoS rise up from less than 50 events per day, up to 300~400 per day. And today's number has already reached 1484, with an hour to go. These numbers are shown in the following figure:\n\n![](__GHOST_URL__/content/images/2018/03/memcache.drdos.trend.1month-update-1.png)\n\nIt should be noted that current Memcache DrDoS is still not the mainstream of DDoS.\nIt accounts for less than 1% in all DRDoS, ranks after DNS, CLDAP, NTP, SSDP, CharGen, L2TP, BitTorrent, Portmap and SNMP.\n\n\n![](__GHOST_URL__/content/images/2018/03/memcache.drdos.trend.1month.distribution.png)\n\n#### The Real Amplification Factors We Tests on Real Network\n\nSo how big the amp factor we should be expecting in real attacks? We performed some tests, as well as analyzed some real attack payloads we captured, and the following are some numbers:\n\n - The amplification factor, from 1k to 60k, can be stably achieved in our testing environment\n - We reached the maximum 60k amplification factor in real network\n - These test results are consistent with those of the original <span style=\"font-family:Times new roman\">0</span>kee team estimates, and the [US-CERT Alarm](Https://www.us-cert.gov/ncas/alerts/TA14-017A).\n - The maximum 60k amplification factor can not be achieved by the attack payload we have captured. Those payloads are somehow problematic, may cause the memcache server crash, so the attack cannot continue. But an easy fix will take care the bug, the attacker would be able to achieve a 60k amplification factor eventually.\n - What is more, even an amplification factor higher than 60k can be made, but we will not discuss the details here.\n\n#### Currently Known Attack Cases\n\nAkamai has just reported [a DDoS attack case](https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html), with the peak attack traffic at 1.3Tbps, a new Akamai record after 2016 Mirai DDoS attack against KrebsonSecuritycom.\n\nOn February 27, Qrator Labs reported [a DDoS attack case](https://medium.com/@qratorlabs/THE-MEMCACHED-AMPLIFICATION-ATTACK-REACHING-500-GBPS-B439A7B83C98) on medium.com. According to the article, this attack is on UDP 11211 port, and convinced Memcache DRDoS, with the peak attack traffic as high as 480Gbps.\n\nBeside these reported cases, we believe other big attacks have actually occurred but not publicly reported.\n\n\n#### Current Countermeasures Taken by ISPs and Security Communities\n\nCurrently, a number of related security notices have already released, part of which: \n\n - Notifications: Multiple security vendors, certs have issued notices, such as [CloudFlare](https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/), [Qrator Labs](https://medium.com/@qratorlabs/the-memcached-amplification-attack-reaching-500-gbps-b439a7b83c98), [Arbor Networks](https://www.arbornetworks.com/blog/asert/memcached-reflection-amplification-description-ddos-attack-mitigation-recommendations/), [US-CERT](https://www.us-cert.gov/ncas/alerts/TA14-017A), and so on\n - Defensive Actions: Multiple ISPs, including [NTT](https://mailman.nanog.org/pipermail/nanog/2018-March/094350.html) have placed rate limits on UDP 11211 port.\n\n\nAt this point, we probably will start to see more bigger attacks, \"G era\" to \"**T era of DDoS**\" might have started.\n\n#### Our DDosMon Memcache page\nWhen event like this happens, one of the security community needs is the visibility, we have temporally setup a webpage [here](https://ddosmon.net/memcached_amplification_attack) on our DDosMon page to track in near real-time about the Memcache attacks, it displays the Memcache attack trend, victims and some statistic, feel free to take a look."}]],"sections":[[10,0]],"ghostVersion":"3.0"}