CO4509 Computer Security: Detailed Report on Memcrashed Exploit

This report provides an in-depth analysis of the Memcrashed vulnerability discovered in 2018, exploring its mechanisms, potential exploits, and effective countermeasures. It begins by describing how Memcached works, including its key components and architecture, and then delves into the specifics of the Memcrashed exploit, focusing on its use in distributed denial-of-service (DDoS) reflection attacks. The report also discusses solutions to mitigate the Memcrashed vulnerability, including disabling UDP support, implementing firewall protection, and patching vulnerable servers. Furthermore, it examines the principles of key-value databases, providing examples and applications, and assesses the future importance and effectiveness of Memcached in light of the vulnerability. The report concludes by emphasizing the importance of following security guidelines to prevent Memcrashed attacks and highlights the effectiveness of recommended actions in mitigating Memcached amplification attacks.

Running Head:MEMCRASHED VULNERABILITY FROM 2018
MEMCRASHED VULNERABILITY FROM 2018
Name of the Student
Name of the University
Author Note

1MEMCRASHED VULNERABILITY FROM 2018
Executive Summary
The aim of this report is to understand how memcached works and how it is used. The report
includes description regarding memcrashed exploit and solution related to memcrash exploit
is also provided. In this report analysis regarding the future importance and effectiveness are
also discussed in details in the following sections.

2MEMCRASHED VULNERABILITY FROM 2018
Table of Contents
Introduction................................................................................................................................3
Discussion..................................................................................................................................4
Memcached working structure...............................................................................................4
Memcached vulnerability.......................................................................................................5
Trend of the protocols abused in Reflection attacks..........................................................5
Memcached DDoS reflection attack..................................................................................5
Ransom request left on Memcached server.......................................................................5
Solution to Memcached exploit.............................................................................................6
Memcached Users..............................................................................................................6
System administrators........................................................................................................6
Developers..........................................................................................................................6
Principle of Key-Value Database...........................................................................................7
Examples of Key-value Stores...............................................................................................7
Uses of Key-Value Database.................................................................................................8
Future importance and effectiveness of memcached.............................................................9
Conclusion..................................................................................................................................9
References................................................................................................................................11

3MEMCRASHED VULNERABILITY FROM 2018
Introduction
Memcached can be defined as distributed memory catching service speed up websites
which are dynamically driven and also Internet services by catching information and objects
in Random Access Memory. Memcached is absolutely free software which is licensed under t
Revised BSD. It is deployed in datacenter, IaaS connections and clouds as well. The survey
that was done by Rapid7 and SANS ISC, comes with the report that there are currently
100,000 memcached servers that are exposed in the Internet protocol. This report describes
about the memcrashed vulnerability from 2018.The discussion will also be related to how
memcrashed works and it is used. Analysis related to the solutions of the memcrashed
problems are also provided in this report. The analysis also include future importance and
effectiveness of memcrashed. The discussion also focuses on the discussion related to key-
value database, simple examples related to it and uses of key-value database, and how it is
related to memcached.

4MEMCRASHED VULNERABILITY FROM 2018
Discussion
Memcached working structure
Memcached comprises of mainly four essential components which allows in storing
and retrieving of data. The elements comprises of raw data,time of expiration and key as well.
At upper level memcached working is in the following manner:
The client at first request for set of information which is again checked by Memcache to
analyse whether the information is stored in the cache or if it is not there..
After the analyse two possible outcomes comes
If information is stored in the cache return data from Memcached
If situation arises that information is not in the cache, then database is queried to retrieve data
and further store in the Memcached
If the time arises that data is altered or the value has expired, Memcached performs the work
of updating the cache determine that fresh information is delivered to the client.
A unique setup has numerous kinds of Memcached servers & numerous clients. The clients
uses an algorithm to ensure which Memcached server to use which helps in distribution of
load. After that in order to determine where it store the value the server computes a second
hash of key order. Some of the points related to Memcached architecture are as follows:
Information can be send to server and nowhere else
Sharing of data is not permitted through servers
Server keeps the value in Random Access Memory. If RAM run out, discarded value will be
the oldest value.

5MEMCRASHED VULNERABILITY FROM 2018
Memcached vulnerability
Many researchers from different cyber Security Company given the report that threat
actors abused the Memcached platform to power distributed service attack which is
commonly known as memcached DDoS attack.
Trend of the protocols abused in Reflection attacks
In this type of protocol the cyber attacker simply sends request to server on port
11211 that spoofs the address of victim. Request that is send to server of the victim is of a
very few bytes but the response is thousands times bigger. The result of this is an
amplification attack that is 51,200 times bigger than the size of the initial request sent (Singh
and Singh 2018).
Memcached DDoS reflection attack
The cyber security observer recognized attacks from 5,700 IPs that are associated
with the Memcached servers. This results in worst situation which can result in a Shodan
query which shows 88,000 not secured Memcached servers, where most are in countries such
as China, US and France.
Ransom request on Memcached server
Extorti attempts that was monitored by Akamai was perfomed by group of attackers
who were forcing victims for 50 Monero, where a situation occurred that the attacks drop
payloads only the memcached server that they intended to target (Borkar et al. 2016). The
group of attackers tried to extort money from numerous business companies giving them
threat that they will attack the companies with DDoS attack which could cause interference to
the operations.

6MEMCRASHED VULNERABILITY FROM 2018
Solution to Memcached exploit
Memcached Users
If a user is using Memcached ,the first thing that the user should do is to first give
instruction to disable UDP support. Memcached start up the user can listen only to localhost
and disable UDP completely.(Natanzon et al. 2015).
System administrators
The user must make sure Memcached servers are fireball protected in internet. To
analyse whether the user can access UDP I recommended the nc, to verify TCP is closed run
in nmap (Choi et al. 2018).
Internet Service Providers
To defeat internet service providers attack in future, user have to fix vulnerable
protocols and also provide IP spooling. The time duration during which IP spoofing is
allowed in internet, the users will be in an unfavourable situation (DELIMITROU and
KOZYRAKIS 2016).
Developers
The most important thing to prevent this type of attacks is by stopping the use of
UDP. Default enabling is prohibited. If the user is not aware about what amplification attack
is the user must type SOCK_DGAM in the editor (Barnes et al. 2018). If the user is using
UDP the user must give their respond with smaller packet size request or else the protocol wil
be abused. Peoples do forget to set up a fireball. The user should avoid protocols that are
UDP-based and that lacks authentication of any kind.
Although Memcached attack is a very dangerous attack which is hard to prevent but these are
the some important information following which users can prevent the attack of Memcached
to some extent.

7MEMCRASHED VULNERABILITY FROM 2018
Principle of Key-Value Database
Key-value database is commonly referred to as key-value store which is a NoSQL
database that apply simple technique to store information (Shams et al. 2019. In Key-value
database storing of data is like collection of value/key pairs. The method is easy to store
information and it also support scaling. In programming language key-value is considered to
be a well-established technique used for coding purpose. Key-value can also be considered as
dictionary or hash.
Examples of Key-value Stores
The examples listed below are simple in structure and the goal is, to give an idea on
working of the key-value database.
Directory of Phone
Key Value
Bijoy (127) 450-78903
Rohit (238) 597-85085
Matiul [phone]
Avishek [phone]
Artist Information
Key Value
Artist:1:genre Analogy
Artist:1:name Analitics
Artist:2:name Territory
Artist:2:genre States

8MEMCRASHED VULNERABILITY FROM 2018
Types of Information that can be stored using Key-Value Database
The Key
Key is used that is applied in key/value database is different in nature.Key/value
database is defined as a key value identifier that gives user the authority to access the value
associated with that of the key.
The Value
Values in key/value store can be long or short, a numeric value, mark-up code which
is related to HTML, programming language like personal home page(PHP) and many
more(Burke, Herbert and Mooi 2018). The values can be list or key/value pair in object..
Uses of Key-Value Database
Application of Key/value database in numerous situations
General Wed/Computers
User profiles
Emails
Status messages
Session information
Networking/Data maintenance
Telephone directories
Data duplication
Internet Protocol tables

9MEMCRASHED VULNERABILITY FROM 2018
Ecommerce websites
Shopping websites contents
Product divisions
Product results
The main function of key/value database is to store entire webpages by applying a single
URL as a key and the values are the webpages. Memcached can also be defined as an inside
memory key/value storage for minute sized information such as string objects from database
calls, calling of API and rendering pages.(Pizzi et al 2016).
Future importance and effectiveness of memcached
Memcached Kill Switch-
Future effectiveness of memcached includes reduction of memcached DDoS attack.
Security firm Corero suggested a “kill switch” to prevent the attack. The “kill switch” include
a ‘flush all” command to the memcached servers, which instruct them to empty their cache
(Liao et al 2017. This can be considered as a well-known instruction and is a part of the
memcached protocol since 2003.But according to Bjarnason there is no need for kill switch
as modern DDoS solutions are capable of defending against memcached DDoS reflective
attacks.
Patching-
Other than the use of kill-switch option number of things have been happening
outside, which help to migrate the volume of memcached attacks (Jin et al. 2017). The open-
source memcached project provides an update that eliminates the attack vector. As stated by
Bjarnason volume of memcached attacks will decrease gradually as access to servers that are
vulnerable continues to shut down (Choi et al. 2018). There will be someone deploying new

10MEMCRASHED VULNERABILITY FROM 2018
vulnerable servers and services on the internet, so these attacks will be part of internet in the
near future.
Conclusion
Therefore, after the analysis of the entire report the conclusion comes out that
vulnerability related to memcrashed can prove to be dangerous in the world of cyber security,
but if the user follows certain guidelines then the used can prevent its system from
memcrashed attack. Detailed analysis is provided related to this top[ic in the entire report
starting from memcrashed vulnerability, solution to memcrashed exploit and future
importance and effectiveness of memcrashed. The analysis was also related to Principle of
Memcache UDP Reflection Amplification Attack. Enumerated recommended Actions and
Solutions to memcached attack is also given. From this analysis the conclusion also comes
out that the Memcached amplification attack can be mitigated effectively by following certain
practices for running of the networked services.

11MEMCRASHED VULNERABILITY FROM 2018
References
Barnes, S.D., WILLIAMS, M.R., Klemetti, M.A., Mahendran, V., Nebogatov, U. and
Vemulapali, M.K., LiveQoS Inc, 2018. UDP over TCP tunnel. U.S. Patent Application
10/097,373.
Borkar, D., Mayuram, R., Sangudi, G. and Carey, M., 2016, June. Have your data and query
it too: From key-value caching to big data management. In Proceedings of the 2016
International Conference on Management of Data (pp. 239-251). ACM.
Burke, I.D., Herbert, A. and Mooi, R., 2018, September. Using network flow data to analyse
distributed reflection denial of service (DRDoS) attacks, as observed on the South African
national research and education network (SANReN): a postmortem analysis of the
memcached attack on the SANReN. In Proceedings of the Annual Conference of the South
African Institute of Computer Scientists and Information Technologists (pp. 164-170). ACM.
Carra, D. and Michiardi, P., 2016. Memory Partitioning and Management in
Memcached. IEEE Transactions on Services Computing.
Choi, J., Lian, R., Li, Z., Canis, A. and Anderson, J., 2018, June. Accelerating Memcached
on AWS Cloud FPGAs. In Proceedings of the 9th International Symposium on Highly-
Efficient Accelerators and Reconfigurable Technologies (p. 2). ACM.
DELIMITROU, C. and KOZYRAKIS, C., 2016. Bolt: Uncovering and Reducing the Security
Vulnerabilities of Shared Clouds.
Jin, Y., Tseng, H.W., Papakonstantinou, Y. and Swanson, S., 2017, February. KAML: A
flexible, high-performance key-value SSD. In 2017 IEEE International Symposium on High
Performance Computer Architecture (HPCA) (pp. 373-384). IEEE.

12MEMCRASHED VULNERABILITY FROM 2018
Liao, J. and Peng, X., 2017. A Data-Consistency Scheme for the Distributed-Cache Storage
of the Memcached System. Journal of Computing Science and Engineering, 11(3), pp.92-99.
Natanzon, A., Cohen, S., Solan, A. and Shemer, J., EMC International Co, 2015. Replicating
key-value pairs in a continuous data protection system. U.S. Patent 8,949,180.
Pizzi, G., Cepellotti, A., Sabatini, R., Marzari, N. and Kozinsky, B., 2016. AiiDA: automated
interactive infrastructure and database for computational science. Computational Materials
Science, 111, pp.218-230.
Shams, K.S., Pandey, P., Sivasubramanian, S., Zaki, O.A., Yanacek, D.C., Olson, J.S., de
Kock, H. and Wu, J.Y., Amazon Technologies Inc, 2019. Local key-value database
synchronization. U.S. Patent Application 10/176,242.
Singh, K. and Singh, A., 2018, October. Memcached DDoS Exploits: Operations,
Vulnerabilities, Preventions and Mitigations. In 2018 IEEE 3rd International Conference on
Computing, Communication and Security (ICCCS) (pp. 171-179). IEEE.