[The posting is sent to APOPS, AfNOG, SANOG, PacNOG, SAFNOG, CaribNOG, TZNOG, 
MENOG, SDNOG, LACNOG, IRNOG, MYNOG, SGOPS, and the RIPE Routing WG.]

UPDATE: As of 2018-02-28, more attacks using the memcached reflection vector 
have been unleashed on the Internet. Operators are asked to port filter 
(Exploitable Port Filters), rate limits the port 11211 UDP traffic (ingress and 
egress), and clean up any memcached exposed to the Internet (iptables on UNIX 
works).  These mitigations should be on IPv4 and IPv6! There is not excuse for 
ISPs, Telcos, and other operators for not acting. NTT is an example of action. 
As stated by Job Snijders <j...@ntt.net <mailto:j...@ntt.net>> on the NANOG 
List:

“NTT too has deployed rate limiters on all external facing interfaces on the 
GIN backbone – for UDP/11211 traffic – to dampen the negative impact of open 
memcached instances on peers and customers.

The toxic combination of ‘one spoofed packet can yield multiple reponse 
packets’ and ‘one small packet can yield a very big response’ makes the
memcached UDP protocol a fine example of double trouble with potential for 
severe operational impact.”

This post has been updated with recommendations. Check with your network 
vendors for deployment/configuration details.

http://www.senki.org/memcached-on-port-11211-udp-tcp-being-exploited/ 
<http://www.senki.org/memcached-on-port-11211-udp-tcp-being-exploited/>

----------------

Attachment: signature.asc
Description: Message signed with OpenPGP

_______________________________________________
Menog mailing list
Menog@lists.menog.org
http://lists.menog.org/mailman/listinfo/menog

Reply via email to