New Active Exploit: memcached on port 11211 UDP & TCP being exploited for reflection attacks
randy at psg.com
Thu Mar 1 23:51:41 UTC 2018
> The defaults for Zimbra seem to be to listen everywhere all the time.
> amidst all the hysterical pontification, i am having trouble finding any
> release which has, by default, a port 11211 listener on any interface.
sorry, i should have said "any operating system release"
yes, you can install memcached
yes, you can install some j random container which has memcached
yes, you can shoot yourself in the foot; welcome to the internet
my point was merely that the hysteria and grandstanding can cost a lot
of ops a bunch of time. and folk should be aware that normal, simple,
vanilla environments will not be a source of reflection.
of course, they might be a target :)
More information about the NANOG