<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">[The posting is sent to APOPS, AfNOG, SANOG, PacNOG, SAFNOG, CaribNOG, TZNOG, MENOG, SDNOG, LACNOG, IRNOG, MYNOG, SGOPS, and the RIPE Routing WG.]</div><div class=""><br class=""></div><div class=""><div class=""><p class="" style="box-sizing: inherit; border: 0px; font-family: Lato, sans-serif; font-size: 15px; margin: 0px 0px 1.5em; outline: 0px; padding: 0px; vertical-align: baseline; color: rgb(88, 88, 90); font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);"><strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">UPDATE: As of 2018-02-28, more attacks using the </strong>memcached<strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> reflection vector have been unleashed on the Internet. Operators are asked to port filter (Exploitable Port Filters), rate </strong>limits<strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> the port 11211 UDP traffic (ingress and egress), and clean up any </strong>memcached<strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> exposed to the Internet (</strong>iptables<strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"> on UNIX works). These mitigations should be on IPv4 and IPv6! There is not excuse for ISPs, Telcos, and other operators for not acting. NTT is an example of action. As stated by Job Snijders <<a href="mailto:job@ntt.net" class="">job@ntt.net</a>> on the NANOG List:</strong></p><blockquote class="" style="box-sizing: inherit; border: 0px; font-family: Lato, sans-serif; font-size: 15px; margin: 0px 1.5em 0px 0px; outline: 0px; padding: 0px 0px 0px 3.5em; vertical-align: baseline; quotes: '' ''; background-image: url(applewebdata://34C49381-1647-44BC-8C02-43CACDFCC6B7/library/images/quote.png); background-color: rgb(255, 255, 255); color: rgb(88, 88, 90); font-variant-ligatures: normal; orphans: 2; widows: 2; background-position: left top; background-repeat: no-repeat no-repeat;"><p class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px 0px 1.5em; outline: 0px; padding: 0px; vertical-align: baseline;"><strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">“NTT too has deployed rate limiters on all external facing interfaces on the GIN backbone – for UDP/11211 traffic – to dampen the negative impact of open memcached instances on peers and customers.</strong></p><p class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px 0px 1.5em; outline: 0px; padding: 0px; vertical-align: baseline;"><strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">The toxic combination of ‘one spoofed packet can yield multiple reponse packets’ and ‘one small packet can yield a very big response’ makes the</strong><br class="" style="box-sizing: inherit;"><strong class="" style="box-sizing: inherit; border: 0px; font-family: inherit; font-style: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">memcached UDP protocol a fine example of double trouble with potential for severe operational impact.”</strong></p></blockquote></div><div class="">This post has been updated with recommendations. Check with your network vendors for deployment/configuration details.</div><div class=""><br class=""></div><div class=""><a href="http://www.senki.org/memcached-on-port-11211-udp-tcp-being-exploited/" class="">http://www.senki.org/memcached-on-port-11211-udp-tcp-being-exploited/</a></div><div class=""><br class=""></div><div class="">----------------</div></div><div class=""><br class=""></div></div></div></div></div></body></html>