Memcached Attack: Exploit, Strategies, and Mitigation

This assignment discusses the memcached attack, its exploit, and strategies to prevent it. It also explores the principles of the key/value database and the future effectiveness of memcached. Learn about the vulnerabilities caused by the memcached attack and how to mitigate them.

Running head: MEMCACHED ATTACK
MEMCACHED ATTACK
Name of Student
Name of University
Author’s Note

1MEMCACHED ATTACK
Table of Contents
Introduction..........................................................................................................................2
Discussion............................................................................................................................2
Principles of the key/value database................................................................................2
Memcrashed exploit.........................................................................................................3
How does the exploit occur?............................................................................................4
Strategies to memcrashed exploit....................................................................................5
Future effectiveness and importance of memcrashed......................................................6
Conclusion...........................................................................................................................7
References............................................................................................................................9

2MEMCACHED ATTACK
Introduction
Mecached can be defined as a strategy using which the memcached is implemented in a
specific system; it can also be implemented in a group of systems. This implementation process
provides security from the vulnerabilities resulted by the memcrashed attack. Memcached is
usually a particular memory object system which can be implemented in the process of caching.
The caching is done in order to boost up the speed of various applications of a specific dynamic
web. Memcached can be defined as a specific open source; this open source can be used in order
to function with various connections that are open in nature (Conklin, White & Cothren, 2015).
The very first memcrashed vulnerability was discovered in February, 2018. In this attack, a
group of attackers had attempted to launch as well as execute an application attack of DDoS, this
attack was very powerful in nature and the attackers had been successful in launching it. This
report discusses various principles that are followed by key/value database; it also provides a
detailed description regarding the concept of memcrashed exploit along with the ways it takes
place (D’Cruze, Wang & Sbeit, 2018). This report further represents some countermeasures or
strategies which can be implemented in order to prevent the exploit. The above mentioned points
are discussed in details in the discussion part of the assignment.
Discussion
Principles of the key/value database
Key-value database can also be called as key-value store, this is described as a storage
paradigm and it is designed for managing, storing along with retrieving the associate arrays. The
database utilizes numerous principles such as examining various options like RocksDB, Badger,

3MEMCACHED ATTACK
GoLevelIDB and Bolt (Dietzel, Smaragdakis & Wichtlhuber, 2018). Some more features that are
meant to be examined are Go, Great read performance, LSM (leveldb), C++, B+tree, a good
balance of read and write performance, Wisckey, cgo and some more. These features are
subparts of the previously mentioned parts. Apart from these some more principles that are
followed by the key/value database is maintaining the simplicity of a specific program. It also
implements the rules of utilizing various algorithms that are simple in nature, besides this it also
follows the implementation of easy data structures in order to use key value database in their
operations (Egelman & Peer, 2015). Along with these, one more principle is explicating, it aims
in building a specific key value database for various purposes instead of delivering a solution
that is generalized in nature.
An example of use of key/value database include suppose a specific set of data is used in
a particular project, and this data would be required for carrying out other projects as well, in this
case the data can be stored in the key/ value database, a key would be provided to the data which
can be utilized in order to get access to the data for future use.
Description of memcrashed exploit
Operating systems and servers: Memcrashed exploit is categorized under the attack
named Distributed Denial of service (DDoS). This is an attack in which a particular attacker or a
group of attackers tried to overload a specific victim who has been targeted; the victim is
overloaded with a particular amount of internet traffic (Kharchenko, Kolisnyk & Piskachova,
2018). After the attacker has spoofed the request to the server or operating system of UDP
memcached which is vulnerable in nature, it floods the victim such that the traffic is potentially
overwhelmed with the resources of the victim. After the infrastructure of the target has been

4MEMCACHED ATTACK
overwhelmed, various new requests that come to it are not processed and hence the regular
traffic does not the access of resource that are available in the internet.
Applications: the activities under memcrashed exploit cause denial of service to various
applications. The contribution of memcrashed attack in the category of denial of service is very
simple and effective, in this specific kind of attack the attacker initiates a request to the targeted
server on the port 11211, and this server is then known to spoof the IP address of the targeted
application. The request that is initiated to the targeted server is composed in various bytes
(Myint, Kamolphiwong & Kamolphiwong, 2019). The response that would be received by the
victim can be of around thousand times larger than the size of the request. This resulted in a
specific amplification attack which has been estimated to be of the size of around 51,200 times
larger compared to the size of request which has been initiated to the victim.
How does the exploit occur?
Description of issues and implications
Unwanted data: Memcrashed attack follows the principles of other DDoS attacks. Some
attacks under the DDoS attacks include DNS amplification as well as NTP amplification. This
attack is carried out by sending numerous spoofs to a vulnerable server; this server is then
responsible for replying with a great amount of data compared to the request that is sent
previously (Hu, Hong & Chen, 2017). This increases the volume of traffic. Memcached attack
can be described as a situation where an individual calls up a retail shop and orders various
substances, he informed the individual over phone to call him back and tell him regarding the
overall cost of his order, when the shopkeeper prepares a bill of the called and calls him up, he
finds that it is a different individual who denies the fact that the order is made by him. In this

5MEMCACHED ATTACK
case the individual is provided with data that is not requested by him (Hyder & Lung, 2018).
This results in memcrashed attack.
Failure in processing the data: The memcashed attack is carried out using numerous
steps; these steps include implanting a good amount of data on the server of memcached that has
been exposed. This data is implanted by the attacker or a group of attackers. After this, the
attacker spoofs the HTTP GET request, the IP address of a specific victim who is considered as a
target (O’Hare, 2018). The memcached server that has received a particular request that tries to
help by providing a respond to the request sends a particular reply to the targeted victim. In this
case, the server that is been targeted fails in processing the vast amount of information that is
sent from the server of memcashed (Peltier, 2016).
Denial of service: the memcrashed exploit overloads the server along with causing denial
of service to any sort of authenticate request. The magnification factor of a specific memcashed
attack strangles in numerous practices, numerous researches had witnessed as well as represented
the whopping 51,200x!. This represents that any 15 byte of a request, replies of around 750 kB
are forwarded. This results in presenting a vast amount of the amplification factor along with the
security risk to web properties (Slocombe, 2018). These properties are not successful in carrying
the weight of same traffic volume of the attack. Having a very high factor of amplification that
are coupled with numerous vulnerable servers change the memcached into a specific use case
which can be used by the attacker or a group of attackers who look for a chance to carry out an
attack DDoS attacks against various targeted servers.
Strategies to secure the issues in memcrashed exploit
Memcached exploit can be mitigated or prevented with the usage of various strategies;
some of these strategies are mentioned below

6MEMCACHED ATTACK
1. Mitigating the failure of data processing: The memcached exploit has the ability to
impose serious threats on a specific operating system and application, for example, a
malicious user is able to bring down the web servers of a particular organization, and this
is usually done by using DDoSing the servers of DNS that are utilized by the particular
organization. In order to prevent this, it is very important to know that DNS servers have
a certain level of redundancy. The redundancies are supposed to be placed in various data
centers. It is very important as well as helpful for the organization to move into a DN
provides that is cloud based (Stallings, 2017). This would be helpful for the company
because it would be help them to provide a high bandwidth with numerous points of
presence at these centers of data which are situated around the world. The services are
designed by considering the fact regarding security against various memcached attacks.
This mitigating strategy is concerned regarding the issue faced by the servers in failing to
process data.
2. Mitigation of receiving unwanted data: Some risks including reflection risks can be
mitigated using numerous methods. Infrastructure of network and memcached server
must be configured after implementing numerous best practices of industry standard
(Wang, Zheng & Lou, 2015). Numerous practices like binding memcached in a specific
source of IP would be utilized. Protection that is usually initiated reduces the risks of
deletion, addition, updating and some more similar risks. This strategy mitigates the
issues regarding unwanted data that has been provided to the victim.
3. Mitigation of denial of service: One way in which the denial of service during
memcached attack can be prevented includes getting access to more bandwidth. In this
mitigation strategy, the basic task that needs to be done include getting access to more

7MEMCACHED ATTACK
bandwidth with the help of various sources. This should be carried out because it helps in
obtaining the ability of handling more amounts of spikes in the traffic which might take
place due to any sort of malicious activity (Yan, Yu & Gong, 2016). Preventing such
malicious activities can be carried out by ensuring that the organization has a very high
level of bandwidth during the time of disposal compared to other attackers. As the level
of vulnerability increases, this particular mitigation strategy cannot be implemented.
Along with this, obtaining access to more amount of bandwidth boosts up the rate of
attackers to overcome even before they initiate in launching an attack that becomes
successful. This mitigation strategy deals with the issues faced due to the denial of
service during the memcrashed attack.
Future effectiveness and importance of memcrashed
Memcashed have various features that are important in nature, these features can be used
by various organizations, and one of the features includes increasing the speed of the process of
application. In this particular case, the memcached concentrates on numerous best practices for
deploying it in the environment as well as applications (Zhang, Zhang & Lee, 2017). This
consists of the feature regarding what an organization needs to store and what is not required for
them to store, it also includes the fact regarding how the organization should handle the
information distribution in an efficient as well as flexible way, the ways that can be used by the
organization in order to regulate the methods for updating the stored version of information
along with memcached (Hyder & Lung, 2018). Memcached also helps in optimizing the speed
that is allowed for accessing and returning the data to the client.
The memcached has the capability of helping an organization in its future operations by
changing its configuration in such a way that it is able to use the cache in order to send the data

8MEMCACHED ATTACK
back, the data that is supposed to send back is the data that usually does not work side by side
with the dynamic nature of various applications which are usually utilized by the company.
Memcached usually gives a memory store which is generalized and is very helpful in holding
anything like objects of native language (Hu, Hong & Chen, 2017). This also helps the
organization in enabling the feature of storing a vast variety of information; this data is then
accessed from various applications and environments. This as a result, helps a specific
organization to use the unused RAM in various servers for using it as a memory cache for storing
the data that are often used. The memcached provides a space that is temporary in nature, this
space is located in the memory of data that is loaded from any place.
Conclusion
From the assignment above, it can be concluded that the implementation of memcrashed
exploits numerous programs of the memcached. It is a specific high performance, open source,
distributed system and object caching. This can be implemented by various social networks like
Facebook, it is also implemented by the creator such as LiveJournal, it is used in the form of a
key value store for the groups which are small and consist of arbitrary data. Mencached is a
program which allows the organizations for taking care of numerous chunks of information. it
can also be used for caching the data of a particular web server. This contributes in increasing the
speed of the sites and this result in creating issue. In most of the cases, the administrator of the
incompetent system exposes numerous servers that are available in internet where memcached is
enabled. Memcached is not usually meant to be available for public usage. This assignment
describes regarding the memcached exploit. It also discusses regarding the way memcached

9MEMCACHED ATTACK
attack occurs and the vulnerabilities caused by it. It also discusses about the techniques that can
be implemented in order to overcome the attacks.

10MEMCACHED ATTACK
References
Conklin, W.A., White, G., Cothren, C., Davis, R. & Williams, D., (2015). Principles of computer
security. McGraw-Hill Education Group.
D’Cruze, H., Wang, P., Sbeit, R. O., & Ray, A. (2018). A software-defined networking (SDN)
approach to mitigating DDoS attacks. In Information Technology-New Generations(pp.
141-145). Springer, Cham.
Dietzel, C., Smaragdakis, G., Wichtlhuber, M. & Feldmann, A., (2018), December. Stellar:
network attack mitigation using advanced blackholing. In Proceedings of the 14th
International Conference on emerging Networking EXperiments and Technologies (pp.
152-164). ACM.
Egelman, S. & Peer, E., (2015), April. Scaling the security wall: Developing a security behavior
intentions scale (sebis). In Proceedings of the 33rd Annual ACM Conference on Human
Factors in Computing Systems (pp. 2873-2882). ACM.
Hu, D., Hong, P., & Chen, Y. (2017, December). Fadm: Ddos flooding attack detection and
mitigation system in software-defined networking. In GLOBECOM 2017-2017 IEEE
Global Communications Conference (pp. 1-7). IEEE.
Hyder, H.K. & Lung, C.H., (2018), December. Closed-Loop DDoS Mitigation System in
Software Defined Networks. In 2018 IEEE Conference on Dependable and Secure
Computing (DSC) (pp. 1-6). IEEE.
Kharchenko, V., Kolisnyk, M. & Piskachova, I., (2018), May. The research of the smart office
availability model considering patches on the router firewall software. In 2018 IEEE 9th

11MEMCACHED ATTACK
International Conference on Dependable Systems, Services and Technologies
(DESSERT) (pp. 169-174). IEEE.
Myint Oo, M., Kamolphiwong, S., Kamolphiwong, T. & Vasupongayya, S., (2019). Advanced
Support Vector Machine-(ASVM-) Based Detection for Distributed Denial of Service
(DDoS) Attack on Software Defined Networking (SDN). Journal of Computer Networks
and Communications, 2019.
O’Hare, J., (2018). Scout: A Contactless ‘Active’Reconnaissance Known Vulnerability
Assessment Tool.
Peltier, T.R., (2016). Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.
Slocombe, G. (2018). World's largest publicly revealed distributed denial of service attack. Asia-
Pacific Defence Reporter (2002), 44(3), 30.
Stallings, W., (2017). Cryptography and network security: principles and practice (pp. 92-95).
Upper Saddle River: Pearson.
Wang, B., Zheng, Y., Lou, W., & Hou, Y. T. (2015). DDoS attack protection in the era of cloud
computing and software-defined networking. Computer Networks, 81, 308-319.
Yan, Q., Yu, F. R., Gong, Q., & Li, J. (2016). Software-defined networking (SDN) and
distributed denial of service (DDoS) attacks in cloud computing environments: A survey,
some research issues, and challenges. IEEE Communications Surveys & Tutorials, 18(1),
602-622.
Zhang, T., Zhang, Y., & Lee, R. B. (2017, April). Dos attacks on your memory in cloud.
In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications
Security(pp. 253-265). ACM.