CO4509 Computer Security Assignment 1: Memcrashed Exploit Analysis

This report provides a comprehensive analysis of the Memcrashed vulnerability, a significant computer security threat. It begins by explaining the principles of key/value databases, a core component of the Memcached system that Memcrashed exploits. The report then details the Memcrashed exploit itself, including how it operates by sending forged UDP messages to Memcached servers to cause a denial-of-service attack. It also outlines potential solutions to mitigate the Memcrashed exploit, such as disabling UDP access and configuring firewalls to restrict access to Memcached servers. Finally, the report assesses the future importance and effectiveness of Memcrashed, considering the increasing prevalence of cloud computing and IoT devices and predicting that real-time service discovery and asset management will be crucial for detecting and preventing these attacks. The report includes references to the sources used.

Running head: COMPUTER SECURITY
Computer Security
Assignment 1
Name of the Student
Name of the University
Author’s Note

1
COMPUTER SECURITY
Table of Contents
Principles of key/value database................................................................................................2
Memcrashed exploits.................................................................................................................3
Solution to memcrashed exploits...............................................................................................4
Future importance and effectiveness of memcrashed................................................................6
References..................................................................................................................................8

2
COMPUTER SECURITY
Principles of key/value database
The key /value database is used for storing a hash table and the access of the database
is maintained using a primary key. The client accessing the database can get the key value,
put the key value or delete the key from data store. The values of keys may be a complex
object compound and it may list data structure and maps. The consistency of the key can be
applied for an operation in single key. The key value database acts as a paradigm for data
store and it is designed for retrieving, management of associative array and dictionary also
known as data structure (Kharchenko, Kolisnyk and Piskachova 2018). The dictionary is
made up of objects or records and it may contain different files containing data. A key is used
for storing and retrieving the records in the database and it helps in uniquely identifying the
records and quickly finding the data residing in the database. The working of key value
database is different from the relational database. In case of the relational database it has a
pre-defined data structure in the form of a table containing fields having data types that are
well defined. The exposure of the data types in the database program helps in optimization
but in case of the key value database the data is treated as a single opaque collection that may
have different fields for each of the records (Ghiëtte and Doerr 2018). The flexibility is
similar as the object oriented programming concept. Less memory space is used by the key
value databases since the optional values present in the database are not represented by the
placeholders or any input parameters. The consumption of less space can improve the
performance of workloads.
There are different consistency models that can eb used by the key value databases
that have support for ordering keys, maintaining data in RAM and employing SSD or rotating
disks. As an example of key value database Oracle NoSQL Database can be used and it can
provide a key value paradigm for the application developer. Here each of the entity acts as a

3
COMPUTER SECURITY
set of key value pairs and there are multiple components of the key and can be specified as an
order list. The entity is identified by the major key and has major components for the key
(Hyder and Lung 2018). There are some subsequent components called as minor key. The
value of the key value pair is considered as an uninterpreted string that have arbitrary length.
The key value data have access for enabling availability and high performance and both the
key and values can have complex compound objects. The key value have lists, data structure
and maps, it helps in improving the consistency that can be applied for operating as a single
key. There are some disadvantages of key vales because no complex query filter can be
applied and all the joins are needed to be done using codes (Tapsell, Akram and
Markantonakis 2018). There are no foreign key constraints and triggers available in key value
and it can problem while joining the tables and provide an appropriate result.
Memcrashed exploits
Memcrashed is a exploit tool written in python and used for sending forged UDP
message to a Memcached server. The Memcached is a memory key value store that stores
small arbitrary data in chunks and it results in API calls, page rendering and API calls. The
Memcrashed codes are free and open source and it is generic in nature applied in distributed
memory object caching system and it is intended for using speeding up the dynamic web
application with the alleviation of the loads in database. For the exploitation of Memcrashed
there is a requirement to install Python on a Linux machine and an upgraded Shodan key is
also needed to be owned by the attacker (O’Hare, 2018). Memcrashed can be used for
exploiting the Memcached utility that stores the data of server in its memory and helps in
reducing the frequency using which the database, other data and APIs are accessed.
Memcached are used for speeding the tome of access to data in a network and it is not
developed for using access in internet and its protocol has no access control or security. The
availability of Memcached as a open source increased problem as a matter for exposing the

4
COMPUTER SECURITY
Memcached but it is not supposed to be exposed to the internet (Mărăşoiu et al. 2016). The
presence of amplification factor in the Memcrashed attack is higher than its predecessor such
as the NTP reflection DDoS attack, having an application factor 556.9. The DNS
amplification attack have amplification factor between 28 to 54.
The Memcrashed attacks requires only the attacker to be able of forging requests to
Memcached server and by default it responds to the request that are directed to UDP port
11211. The protocol used in Memcached allows the hosts for sending a stat command which
in turn returns the current statistics of the network traffic. 15 bytes of data is used by the
request but the Memcached server statistic may be more than 1 mb (Nair, Umamaheswari and
Kuppusamy 2016). The Shodan service is used for searching the vulnerable server and the
servers are those that are open of requesting UDP port 11211 and its default inbound port for
caching protocol and is enabled by default in the implementation. From a research it has been
identified that there are nearly 100,000 vulnerable devices that are utilized for memcrashed
DDoS exploits. The exploitation of the Memcached server can be prevented by turning off
the access to Memcached using UDP or by removal of internet access to the Memcached
servers. If it is seen that the server is being attacked from port 11211 the traffic from the port
can be blocked as all the operating system use higher source port than the client connection
(Wijs, 2016). The Memcached program is exploited for proper working of Memcrashed and
it is generally used by the social network where the user request is higher. It helps in handling
large number of input and output for speeding the sites. Since the Memcached server has no
authentication mechanism it should not be made available in the internet.
Solution to memcrashed exploits
There is an increase in the UDP amplification and reflection attack over the internet
and the attacks uses the Memcached protocol and originates from the UDP 11211 port.

5
COMPUTER SECURITY
Ordinary sized packets are sent by the attacker from a spoofed IP address having destination
address of the Memcached running server. An elicit large response is requested from the
Memcached for congesting the targeted network quickly and causing denial of service
scenario for the network (Riaz, Alam and Ali 2017). For the mitigation of this type of attack
the inbound and outbound data traffic for the UDP 11211 port is needed to be blocked from
the edge network but it is a temporary solution. Only sending and receiving of UDP traffic
for port 11211 is blocked and network can have communication with the other nodes using
the UDP 11211. Memcached should not be exposed over internet and the following steps are
needed to followed for securing the servers.
If there is a need for communication of the Memcached server for the private network
a private IP address is needed to be bind with the Memcached server along with a port. A
firewall is needed to be configured and it is needed to be set up at the distribution level
according to the firewall guidelines (Awasthi et al. 2015). If there is no need for the
Memcached to be communicated over any of the other network connection the UDP for the
Memcached is needed to be disabled and it should be ensured that the server listens to the
localhost.
With the growth of the internet there has been an increase in large scale UDP
amplification and reflection attacks over the internet and the attacks uses the Memcached
protocol which originates from the 11211 port. A spoofed IP is used for sending the ordinary
sized UDP packets targeted for the server running the Memcached protocol. The requests are
highly resource demanding and large packets are responded from the memcached server for
congesting the victims network and causing denial of service (Wu and Zheng 2016). It is
important to block the internet access to the Memcached and the following steps are needed
to be performed such that the Memcached instance can be secured. If there is a requirement
for the Memcached to communicate with the private network the Memcached is needed to be

6
COMPUTER SECURITY
bind to a specific port and IP address. The Linode firewall is needed to be configured with the
rules of distribution and the firewall guides are needed to be followed (Kourtis, Ioannou and
Koltsidas 2019). If there is no need of communication for the Memcached over the network
the UDP port is needed to be disabled and it is needed to be ensured that the server listens
only to the localhost. By default Memcached is configured such that it is listening to the
incoming connection from different IP address on the RHEL based distribution for the UDP
and TCP. As precaution the UDP is needed to be disabled and the configuration is needed to
be changed such that it listens to the localhost.
Future importance and effectiveness of memcrashed
The DDoS attack is not new but with the emergence of cloud computing and IoT
devices it has become a easier to launch the massive attacks. The largest attack is recorded to
be 1.3 Tbps which was done using Memcached as a reflection attack using the UDP port. The
involvement of the Memcached server in distributed denial of service amplifies the attacks
and it can 3 times more than the previous attacks. The entire internet community is involved
in the response and each of the IoT devices, DNS server are exposed with the UDP service
similar with Memcached and its access is needed to be restricted (Jeyaraj and
Ananthanarayana 2018). The hybrid, massive and distributed nature increases the hardness to
know the content and letting the services vulnerable and exposed for the attacks. There are
different organizations which have left open the vulnerable services and failed to implement
the best practices for the detection and rejection of spoofed traffic. The real time service
discovery and asset management is important for increasing the level of awareness and
address the threats. Real time monitoring helps in permitting an immediate response in the
early stage of Memcrashed and the other DDoS attacks for stopping the attacks to track the
activity and thus increasing the protection for the community members and intended target
(Ajoux et al. 2015). The implementation of Extra Hops helps in detecting all the assets and

7
COMPUTER SECURITY
the devices as the devices communicate with each other over the network for understanding
the protocols that are used for providing early warning. A continuous monitoring of the
system is necessary for reducing the potential risk and generate early warning for the
exploitation. The extra hops also helps in detecting the misconfigured service and deeper
detection with the help of additional configuration.
Memcached is used as a general purpose distributed caching system and utilized for
speeding up the dynamic database for caching data and objects in the computer memory and
reducing the number of times the data source is needed to be read. Memcached is an open
source and free software that can be installed in the server because it helps in providing a
large hash table which is distributed across more than one computer (Bremler-Barr et al.
2017). Memcached finds its application and it has no mechanism for tracking the misses and
third party utilities providing different functionality. Memcached are used by Youtube,
Facebook, Twitter, Amazon Web Service for providing service using the API. A client server
application model is used by the system and the server is used for maintaining key value
associative array and populates the array and querry using the key (Kloostra 2015). The client
side libraries are used by the client for contacting with the other server and the service are
exposed at the port 11211. In future the security for the Memcached server is needed to be
increased such that an exercise control can eb enforced over the client.

8
COMPUTER SECURITY
References
Ajoux, P., Bronson, N., Kumar, S., Lloyd, W. and Veeraraghavan, K., 2015. Challenges to
adopting stronger consistency at scale. In 15th Workshop on Hot Topics in Operating
Systems (HotOS {XV}).
Awasthi, M., Suri, T., Guz, Z., Shayesteh, A., Ghosh, M. and Balakrishnan, V., 2015,
January. System-level characterization of datacenter applications. In Proceedings of the 6th
ACM/SPEC International Conference on Performance Engineering (pp. 27-38). ACM.
Bremler-Barr, A., Hay, D., Moyal, I. and Schiff, L., 2017, June. Load balancing memcached
traffic using software defined networking. In 2017 IFIP Networking Conference (IFIP
Networking) and Workshops (pp. 1-9). IEEE.
Ghiëtte, V. and Doerr, C., 2018, August. How Media Reports Trigger Copycats: An Analysis
of the Brewing of the Largest Packet Storm to Date. In Proceedings of the 2018 Workshop on
Traffic Measurements for Cybersecurity (pp. 8-13). ACM.
Hyder, H.K. and Lung, C.H., 2018, December. Closed-Loop DDoS Mitigation System in
Software Defined Networks. In 2018 IEEE Conference on Dependable and Secure
Computing (DSC) (pp. 1-6). IEEE.
Jeyaraj, R. and Ananthanarayana, V.S., 2018, June. Dynamic Performance Aware Reduce
Task Scheduling in MapReduce on Virtualized Environment. In 2018 IEEE 16th
International Conference on Software Engineering Research, Management and Applications
(SERA) (pp. 211-218). IEEE.
Kharchenko, V., Kolisnyk, M. and Piskachova, I., 2018, May. The research of the smart
office availability model considering patches on the router firewall software. In 2018 IEEE

9
COMPUTER SECURITY
9th International Conference on Dependable Systems, Services and Technologies
(DESSERT) (pp. 169-174). IEEE.
Kloostra, S., 2015. Joomla Performance and Speed. In Joomla! 3 SEO and Performance (pp.
127-157). Apress, Berkeley, CA.
Kourtis, K., Ioannou, N. and Koltsidas, I., 2019. Reaping the performance of fast {NVM}
storage with uDepot. In 17th {USENIX} Conference on File and Storage Technologies
({FAST} 19) (pp. 1-15).
Mărăşoiu, M., Blackwell, A.F., Sarkar, A. and Spott, M., 2016, June. Clarifying hypotheses
by sketching data. In Proceedings of the Eurographics/IEEE VGTC Conference on
Visualization: Short Papers (pp. 125-129). Eurographics Association.
Nair, A.B., Umamaheswari, R. and Kuppusamy, P., 2016. A Machine Learning-based State-
of-the-art Approach to Identifying the Person behind an E-mail ID. International Journal of
Computer Applications, 975, p.8887.
O’Hare, J., 2018. Scout: A Contactless ‘Active’Reconnaissance Known Vulnerability
Assessment Tool.
Riaz, F., Alam, M. and Ali, A., 2017, August. Filtering the big data based on volume, variety
and velocity by using Kalman filter recursive approach. In 2017 IEEE 3rd International
Conference on Engineering Technologies and Social Sciences (ICETSS) (pp. 1-6). IEEE.
Tapsell, J., Akram, R.N. and Markantonakis, K., 2018. An evaluation of the security of the
Bitcoin Peer-to-Peer Network. arXiv preprint arXiv:1805.10259.
Wijs, A.J., 2016. GPUexplore: GPU explicit-state model checking.

10
COMPUTER SECURITY
Wu, J. and Zheng, Z., 2016, August. A PaaS based E-government security framework and its
application. In 2016 7th IEEE International Conference on Software Engineering and
Service Science (ICSESS) (pp. 969-972). IEEE.