New Active Exploit: memcached on port 11211 UDP & TCP being exploited for reflection attacks

Wed Feb 28 11:28:42 UTC 2018

On Tue, Feb 27, 2018 at 04:13:23PM -0800, Dan Hollis wrote:
> OVH does not suprise me in the least.
> 
> Maybe this is finally what it will take to get people to de-peer them.

Let's hope so.  There are two, and only two possibilities.

1. They know what's going on in their operation.  In that case, they're
fully aware of all the spam, phishing, attacks, abuse, etc., and are
choosing to actively support and encourage them because it's profitable.

2. They don't know what's going on in their operation.  In that case,
they're amazingly ignorant and stunningly incompetent -- because we
all know what's going on in it and we're not even there.

But in either case, the operational impact on us is exactly the same
and so is the solution.

---rsk