Hackers Chronicle - Online Cyber Security News: Memcache

DDoS Exploit code to shutdown all vulnerable Memcached Servers Released online

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY_2biyz6S2H06vEQZNYt30moJnaKa9N1pO73gCZfgMo8cGLLI66wvY61YLyK_XtqjucFRcLrrwNEmDa3pBhJpig0791kXy2_uaPo5hU5-D2hMUlZIG2zQfPmrgfr-3safsS6y51p6X4xI/s1600/Memfixed-Mitigation-Tool.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="MEMFIXED DDOS MITIGATION TOOL" border="0" data-original-height="455" data-original-width="822" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY_2biyz6S2H06vEQZNYt30moJnaKa9N1pO73gCZfgMo8cGLLI66wvY61YLyK_XtqjucFRcLrrwNEmDa3pBhJpig0791kXy2_uaPo5hU5-D2hMUlZIG2zQfPmrgfr-3safsS6y51p6X4xI/s640/Memfixed-Mitigation-Tool.png" title="memfixed-ddos-mitigation-tool" width="640" /></a></div>
<br />
For the last few days, Vulnerable Memcached Servers were targeted by hackers to conducted DDoS attacks including the <a href="http://www.hackerschronicle.com/2018/03/github-hit-with-biggest-ddos-attack.html" target="_blank">world’s largest ever 1.7 Tbps of DDoS attack on Github</a> website.<br />
<br />
After the massive attacks on memcache servers worldwide <b>three PoC codes were published online to exploit the thousands of Memcache servers still vulnerable</b>. Along with PoC code a <b>list of 17,000 vulnerable servers were also published</b>. The PoC codes could allow even script-kiddies to launch massive <a href="http://www.hackerschronicle.com/search/label/DDoS" target="_blank">DDoS </a>attacks using UDP reflections easily.<br />
<br />
But now the researchers at <a href="https://twitter.com/SpuzNiq">SPUZ.me</a> have released a new tool to shutdown all vulnearble sers at one go. The tool is named as <a href="http://www.hackerschronicle.com/search/label/Memfixed" target="_blank"><b>Memfixed</b></a>. According to the publisher: Memfixed is DDoS mitigation tool for sending flush or shutdown commands to vulnerable <a href="http://www.hackerschronicle.com/search/label/Memcache" target="_blank">Memcached </a>servers obtained using Shodan API.<br />
<br />
This tool is written in python and this allows you to shutdown/flush vulnerable Memcached servers obtained from <b>Shodan </b>search engine and utilising the killswitch published by a security researcher dormando. He has discovered a “kill switch” to counteract the Memcached vulnerability that recently fueled some of the largest distributed denial-of-service (DDoS) attacks in history. The tool also has the capability of shutting down or flushing specific vulnerable memcached servers for companies/services being attacked (assuming the user knows its IP address).<br />
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1K4iyFU004iDBDOTT5G39GzNB3E6VyxpcWew_pRnlbq6zzYuTjkPAd_9oDOpjdOTM4RBJ2R4KvVWTtl-wN-KHX3HnJDmCB7_KOy8EXBMKSgtusro5x01MdFQjlOAqRQI_hHJS64ZG7-Ls/s1600/Memcrashed-DDoS-Exploit.PNG" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Memcached DDoS Exploit Code" border="0" data-original-height="588" data-original-width="592" height="634" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1K4iyFU004iDBDOTT5G39GzNB3E6VyxpcWew_pRnlbq6zzYuTjkPAd_9oDOpjdOTM4RBJ2R4KvVWTtl-wN-KHX3HnJDmCB7_KOy8EXBMKSgtusro5x01MdFQjlOAqRQI_hHJS64ZG7-Ls/s640/Memcrashed-DDoS-Exploit.PNG" title="memcached-ddos-exploit-code" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Poc code to exploit vulnerable Memcache servers</td></tr>
</tbody></table>
<br />
Memcached is a popular open source distributed memory caching system, which came into news earlier last week when researchers detailed how hackers could abuse it to launch amplification/reflection DDoS attack by sending a forged request to the targeted Memcached server on port 11211 using a spoofed IP address that matches the victim's IP.<br />
<br />
For those unaware, Memcached-based amplification/reflection attack amplifies bandwidth of the DDoS attacks by a factor of 51,000 by exploiting thousands of misconfigured Memcached servers left exposed on the Internet.</div>

DDoS Exploit Memcache Memfixed News DDoS Exploit code to shutdown all vulnerable Memcached Servers Released online

For the last few days, Vulnerable Memcached Servers were targeted by hackers to conducted DDoS attacks including the world’s largest eve...

GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s1600/github-under-biggest-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" border="0" data-original-height="577" data-original-width="770" height="476" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s640/github-under-biggest-ddos-attack.png" title="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" width="640" /></a></div>
On Wednesday, developer repository site <a href="http://www.hackerschronicle.com/search/label/GitHub" target="_blank">GitHub </a>was hit with a critical DDoS attack that took the site offline multiple times for a few minutes each time. According to a GitHub incident report, the first portion of the <b>attack</b> against the developer platform <b>peaked at 1.35Tbps</b>, and there was a second 400Gbps spike later. This would make it the biggest <a href="http://www.hackerschronicle.com/search/label/DDoS" target="_blank">DDoS </a>attack recorded so far. Until now, the biggest clocked in at around 1.1Tbps.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s1600/GitHub-hit-by-memcached-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Under Memcached Attack" border="0" data-original-height="515" data-original-width="1357" height="241" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s640/GitHub-hit-by-memcached-attack.png" title="GitHub Under Memcached Attack" width="640" /></a></div>
<br />
According to the <a href="https://githubengineering.com/ddos-incident-report/" target="_blank">incident report</a>, <b>GitHub was offline</b> Wednesday from 17:21 to 17:26 UTC and intermittently unavailable from 17:26 to 17:30 UTC, thanks to the attack. The report noted that <b>user data wasn't at risk during the attack</b>.<br />
<br />
The GitHub attack is the latest in a string of incidents where hackers have exploited a vulnerability in the <a href="http://www.hackerschronicle.com/search/label/Memcache" target="_blank">memcached </a>protocol to amplify the impact of such an attack. Memcached is typically used to speed up websites, but an issue with its UDP protocol makes the attack amplification possible, as noted by <a href="http://www.hackerschronicle.com/search/label/CloudFlare" target="_blank">CloudFlare</a>. <br />
<br />
Memcached, as is likely inferred by the name, is a tool that uses data caching to help ease the burden on data stores, it's not necessarily meant to be used with systems that are connected to the internet. But, that hasn't stopped attackers from finding a way to use it to launch and accelerate cyberattacks. By mislabeling a victim's IP as a target address, attackers can overload their network with traffic (up to 51,200x more in acceleration) and trigger a denial of service attack.<br />
<br />
<div style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s1600/memcache-ddos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="411" data-original-width="640" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s400/memcache-ddos.png" width="400" /></a></div>
To fix its own problem, GitHub moved some of its traffic to Akamai for additional capacity at the edge. In its own post <a href="https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html" target="_blank">Akamai</a>, one of the companies who discovered the vulnerability early on, wrote that it predicts "many more, potentially larger attacks in the near future. Akamai has seen a marked increase in scanning for open memcached servers since the initial disclosure."<br />
<br />
Josh Shaul, vice president of web security at Akami told, “we modeled our capacity based on five times the biggest attack that the internet has ever seen. So I would have been certain that we could handle 1.3 Tbps, but at the same time we never had a terabit and a half come in all at once.”<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s1600/GitHub-under-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub under DDOS attack" border="0" data-original-height="137" data-original-width="720" height="120" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s640/GitHub-under-ddos-attack.png" title="GitHub under DDOS attack" width="640" /></a></div>
<br />
<br />
There are few parallels to the scale of the attack, with GitHub saying there were “over a thousand different autonomous systems across tens of thousands of unique endpoints.”  </div>

Cyber Attack DDoS GitHub Memcache News GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

On Wednesday, developer repository site GitHub was hit with a critical DDoS attack that took the site offline multiple times for a few ...

DDoS Exploit code to shutdown all vulnerable Memcached Servers Released online

GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

Popular

Comments

Archive