2

In terms of early detection, how could a sysadmin detect that a Memcached DDoS attack took place?

Improve this question
1
  • 3
    Took place or are taking place?
    – Tom K.
    Commented Sep 4, 2018 at 8:36

2 Answers 2

Reset to default
1

If you are the one being exploited to carry out the attack, you will see heavy traffic leaving your server from UDP port 11211 and a small amount of incoming traffic from the attacker's machine to said port (with the source IP spoofed to appear to be that of the target). However, it would be best for you simply to configure Memcached so it is not exposed to the internet. This can be done by editing its configuration file and binding it to localhost. If on the other hand you are the target, you will see a large amount of incoming traffic from many servers coming from UDP source port 11211.

If you use Snort, there is a detection rule available for it.

Improve this answer
0

You can analyze the next tool https://github.com/649/Memcrashed-DDoS-Exploit and create a Snort/Suricata/AIengine signature for it, on the other hand you can follow the approach of volumen of UDP on your memcache services and detect a spike on those services.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .