On February 28th, 2018, GitHub reported that it experienced the largest DDoS attack on record, with a maximum volume of 1.35Tbps.
Many applications use a memory caching system called “memcached“. Administrators set up a memcached server in order to make frequently used content or data easier to access, reducing strain on individual instances. By submitting a query for previously used data, the user will get the information faster without additionally burdening the system. Since memcached doesn’t require authentication, most admins set it up only for internal use. However, misconfigurations means that these servers can often reach the internet.
An attacker can trigger a DoS by purposefully making the memcached server store large quantities of data. Since memcached previously enabled UDP communications by default, an attacker can send a single byte of data to the server and get large quantities of data back, up to 51,000 times as much. Again, the attacker can do this continuously since no authentication is necessary. By spoofing the source IP, pretending the victim sent the request, the victim will get the reply, and the attacker can trigger a DoS with very little work. By causing hundreds or thousands of machines to do the same thing, the amount of traffic the victim gets can easily hit the hundreds of gigabits or terabits per second, exactly what happened to GitHub.
What This Means
So how can you prevent or protect against an attack like this?
echo -en "\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n" | nc -q1 -u 127.0.0.1 1121
Secure Compliance Solutions is the trusted security advisor for Chicagoland’s small-to-medium businesses. We offer a variety of services that promote a strengthened security posture and a culture of compliance. Our solutions include: risk advisory services, strategic cybersecurity planning, security and privacy awareness, regulatory guidance, penetration testing, and managed security services. We tailor our engagements and solutions to align with your cultural needs and business objectives; not the other way around. We keep your appetite for risk, budget constraints, and timeline in mind to define strategy and operational tactics that maximize your return on investment. At SCS, we help you navigate the course of your cybersecurity journey.