New Active Exploit: memcached on port 11211 UDP & TCP being exploited for reflection attacks

Wed Feb 28 12:31:11 UTC 2018

Dear all,

Before the group takes on the pitchforks and torches and travels down to
the hosting providers' headquarters - let's take a step back and look at
the root of this issue: the memcached software has failed both the
Internet community and its own memcached users.

It is INSANE that memcached is/was[1] shipping with default settings
that make the daemon listen and respond on UDP on INADDR_ANY. Did nobody
take notes during the protocol wars where we were fodder for all the
CHARGEN & NTP ordnance?

The memcached software shipped with a crazy default that required no
authentication - allowing everyone to interact with the daemon. This is
an incredibly risky proposition for memcached users from a
confidentiality perspective; and on top of that the amplification factor
is up to 15,000x. WHAT?!

And this isn't even new information, open key/value stores have been a
security research topic for a number of years, these folks reported that
in the 2015/2016 time frame they observed more than 100,000 open
memcached instances: https://aperture-labs.org/pdf/safeconf16.pdf

Vendors need to ensure that a default installation of their software
does not pose an immediate liability to the user itself and those around
them. No software is deployed in a vacuum.

A great example of how to approach things is the behavior of the
PowerDNS DNS recursor: this recursor - out of the box - binds to only
127.0.0.1, and blocks queries from RFC 1918 space. An operator has to
consciously perform multiple steps to make it into the danger zone.
This is how things should be.

Kind regards,

Job

[1]: https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974

ps. promiscuous defaults are bad, mmkay?
Ask your BGP vendor for RFC 8212 support today! :-)