2

In terms of early detection, how could a sysadmin detect that a Memcached DDoS attack took place?

  • 3
    Took place or are taking place? – Tom K. Sep 4 '18 at 8:36
1

If you are the one being exploited to carry out the attack, you will see heavy traffic leaving your server from UDP port 11211 and a small amount of incoming traffic from the attacker's machine to said port (with the source IP spoofed to appear to be that of the target). However, it would be best for you simply to configure Memcached so it is not exposed to the internet. This can be done by editing its configuration file and binding it to localhost. If on the other hand you are the target, you will see a large amount of incoming traffic from many servers coming from UDP source port 11211.

If you use Snort, there is a detection rule available for it.

0

You can analyze the next tool https://github.com/649/Memcrashed-DDoS-Exploit and create a Snort/Suricata/AIengine signature for it, on the other hand you can follow the approach of volumen of UDP on your memcache services and detect a spike on those services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.