CO4509 Computer Security: A Detailed Report on Memcrashed Exploit

This report provides a comprehensive analysis of the Memcrashed vulnerability, a significant security exploit from 2018. It begins by explaining the principles of key-value databases and introduces Memcached, detailing its working mechanisms and functions. The report then describes the Memcrashed attack, elaborating on how attackers exploit Memcached servers to launch distributed denial-of-service (DDoS) attacks. Mitigation strategies to defend against Memcrashed are discussed, including rate-limiting UDP traffic and implementing real-time network visibility. Finally, the report assesses the future importance and potential impact of the Memcrashed exploit, concluding with key findings and recommendations. This document is available on Desklib, a platform offering study tools and resources for students.

Running head: MEMCRASHED VULNERABILITY
MEMCRASHED VULNERABILITY
Name of student
Name of university
Author’s note:

1
MEMCRASHED VULNERABILITY
Table of Contents
Introduction....................................................................................................................2
Discussion......................................................................................................................2
Principles of key/value databases...............................................................................2
Memcached................................................................................................................3
Working and functioning of memcached...................................................................3
Memcrashed attack.....................................................................................................5
Working of memcrashed attacks................................................................................5
Mitigation strategies of memcrashed attack...............................................................6
Analysis of future importance of this exploit.............................................................7
Conclusion......................................................................................................................8
References......................................................................................................................9

2
MEMCRASHED VULNERABILITY
Introduction
This report aims to discuss the topic of memcrashed vulnerability. The principles of
the key/value databases is briefly discussed in this report with the example of the use of the
key/value databases. The description of the memcrashed exploit is briefly discussed in this
report. The solutions of memcrashed exploit is briefly discussed. An analysis of the possible
future importance and the effectiveness of the memcrased exploit is briefly indicated in the
report. The report concludes with a conclusion for the report.
Discussion
Principles of key/value databases
Key-value database is the paradigm of data storage that is designed for the storage,
retrieval, and management of the associative arrays, data structure that is popularly known as
the hash table or dictionary (Lim et al. 2013). The dictionaries comprises of the collection of
records or objects that comprises of the fields in them and each comprising of data. The
storing and the retrieval of the records is done using any key that uniquely identifies the
record, and it is utilised for the easy finding of the data in the database. The key-value
databases functions in immensely dissimilar methods from the commonly known RDB or the
relational databases. The exposing of the data types to programs of the database permits it to
perform the application of the numerous optimisations (Chalamalasetti et al. 2013). The
systems of the key-value treats the data as the sole collection that is opaque that might consist
of dissimilar fields for each record. This provides the considerable flexibility and follows the
modern concepts like the programming that is object-oriented. As the representation of the
optional values is not done by the placeholders or the parameters of input as in the majority
of the RDBs, the key value databases frequently utilises significantly lower memory for
storing the similar database that could lead to the huge gains in the performance in the

3
MEMCRASHED VULNERABILITY
particular workloads. The performance in the particular workloads (Lavasani, Angepat and
Chiou 2014). The performance, lack of standardisation and any other issues restricted the
systems of key-value to niche the uses for significant time. Several graph databases are the
key-value databases internally as it adds the concept of relationships among the records as the
first class data type.
Memcached
The aspect of Memcached is the commonly used distributed system of memory
caching. It is commonly utilised for the speeding up websites that are driven by the dynamic
databases by the caching of the data along with the objects in RAM for reducing number of
the times any reading of the external source of data has to be done (Ruan et al. 2014).
Memcached is the open-source and free software. This system executes on the operating
systems like Unix and it also functions on Microsoft Windows. This depends on the libevent
library. The API of memcached offers huge hash table that is distributed through several
machines. In the situation when this table becomes full, the successive inserts leads the
purging of the older data in the LRU order, which denotes to the Least Recently Used. The
applications that are using the memcached commonly layers the additions and requests in the
RAM before falling back on the slower store of backing like the databases (Xu et al. 2014).
The memcached consist of no internal mechanism for tracking the misses that might happen.
Moreover, several utilities of any third party offers this functionality.
Working and functioning of memcached
This systems utilises the architecture of client server. The servers maintains the
associative arrays of key-value, then the clients populates the array and then queries it by the
key (Carra and Michiardi 2014). The length of the keys could be upto 250 bytes and the
values could be maximum 1 megabyte in the size. The clients utilises the libraries of the
client side for contacting with the servers that are by default exposes the service at the port

4
MEMCRASHED VULNERABILITY
11211. Both the UDP and the TCP are supported. Every client has the knowledge about all
the servers and the servers does not communicate with one another. If any individual wants to
read of set the value as per any particular key, the computation of library of the client is done
for any hash of the key for determining the correct server for utilising. This provides the
simple form of the sharding and the scalable architecture of shared nothing all across the
servers (Zhang et al. 2014). The computation of the second hash is done of the key by the
server for determining the correct position for storing or reading any corresponding value.
The values are stored in the RAM by the servers and if any server runs out of the RAM then
it discards values that are oldest. Hence, the clients should treat the memcached as the
transitory cache, and any assumptions cannot be made about the fact that the data, which is
stored in the memcached is still present and would be available according to the
requirements. If all the libraries of the client utilises the similar algorithm of hashing for
determining the servers, then the clients could read the cached data of one another. Any
common deployment consists of several clients and servers. Moreover, it might be possible
that the Memcached could be used on any single computer that acts simultaneously as the
server and the client. The size of the hash table is commonly extensive (Lavasani, Angepat
and Chiou 2013). It might be restricted to the accessible memory through each server within
the cluster of the servers in any data center. Where the huge-volume, vast audience web
issuing needs it, it might be stretched to several gigabytes. The Memcached could be equally
valuable to the situations where the request numbers for the content might be high or the cost
of the generation of any specific content piece is significantly high.
Most of the deployments of the Memcached are in the trusted network where any
client might be freely connect to any server. Moreover, there might be situations where the
Memcached could be deployed in the untrusted network or where any administrator wants to
exercise the control over any client, which are connecting (Fukuda et al. 2014). For fulfilling

5
MEMCRASHED VULNERABILITY
this purpose the compilation of the Memcached could be done with the optional support of
SASL authentication ((Fukuda et al. 2014). The SASL support needs the binary protocol.
Even in any trusted organisation, flat model of trust of the memcached might have several
security implications. For the effective simplicity, all operations of memcached are equally
distributed. The clients with the valid requirement for the access for the entries that are of
low-security in the cache might gain the access to all of the entries in the cache even when
these might comprise of higher security and the client might not have the justifiable
requirement for these.
Memcrashed attack
Dubbed as the Memcrashed by cloudflare, this attack commonly misuses the
Memcached servers which are unprotected and consist of the UDP enabled for delivering the
DDoS attacks and this makes it most noticeable method of amplification. The cybercriminals
have discovered a method for abusing the vastly utilised Memcached servers for launching
significantly huge DDoS attacks which is greater than the unique strength that could lead to
the hitting down of the popular websites along with the arrangement of internet (Marathe et
al. 2017). The memcached has grown to be the widespread open-source and swiftly
deployable disseminated system of caching, which permits the storing of the objects in the
memory and it has been designed for working with numerous open connections. The
designing of the application of Memcached has been done for increasing the speed of
dynamic web applications with the reduction of the stress on the database, which assists the
administrators to surge the performance and then measure the applications on web (Blott et
al. 2015).
Working of memcrashed attacks
The memcrashed attacks are used as the amplification of the cache memory of the
systems. Like any other methods of amplification where any hacker transmits any small

6
MEMCRASHED VULNERABILITY
request from the spoofed IP address for gaining any greater response in the return, the
Memcrashed amplification attack could also work with the transfer of any counterfeit request
to targeted server on the port utilising any deceived IP address, which equals the IP of the
victim (Islam et al. 2014).. Combined, the researchers have viewed several distinct source IP
addresses that are connected with the vulnerable servers of Memcached (Fan, Andersen and
Kaminsky 2013). The attack of Memcrashed is simple and it requires solely that attackers
would be able to forge the requests for memcached servers that by default responds to the
requests focussed to the UDP port. The protocol of Memcached permits the hosts to drive any
command of stats which returns the present statistics of traffic (Lu et al. 2014). An extensive
search for discovering the vulnerable servers on the Shodan service, which is a host that is
running the memcached, which are open for requests on the UDP port 11211 that is the
default inbound port for caching protocol and is enabled by the default in several
implementations provided the evidence that several devices are presently vulnerable in being
utilised for Memcrashed DDoS exploit days even after that exploit was reported initially.
GitHub faced an attack in 2018 due to the DDoS attack.
Mitigation strategies of memcrashed attack
The common mitigation technique that is used for preventing the misuse of the
memcached servers as the reflectors is the rate-restricting the UDP on the source port 11211
or firewalling and blocking. As the Memcached eavesdrops on the INADDR_ANY that is an
IP address and also it executes with support of the UDP that is allowed by default, the
administrators are recommended to disable the support of UDP if it is not being utilised. The
anticipation of the critical assets that includes the network services and the applications that
might be targeted by the attackers and then make sure that the detection of monitoring and the
emergency plans for response particularly aligns to these assets (Karras, Blott and Vissers
2014). The suitable procedures could be implemented for re-routing the traffic for the

7
MEMCRASHED VULNERABILITY
scrubbing in cloud. The enterprises requires to implement the real-time visibility in their own
behaviour of network with the machine learning for detecting the anomalous spikes in the
traffic. The defences in the perimeter are commonly unable to restrict the less sophisticated
memcrashed attacks and it would be difficult for the defences to restrict any huge form of
memcrashed attack (Liu et al. 2015). Significant attention has to be paid to the application
layer. It denotes the ensuring of having the ability of performing the deep-packet inspection
at application layer and if possible, then redundancies could be added by the deploying of the
critical applications on the multiple providers of public cloud for scaling out the next
deployment if it is attacked (Shankar et al. 2015). Another mitigation strategy that could be
applied for protecting against the DDoS attack is investing in the real-time visibility in the
traffic of network. One of the simplest methods that could act as the defence against any
DDoS attack is either the whitelisting of only the legitimate IP addresses or the blocking of
the ones from the unknown attackers. As an instance, in any organisation there is a range of
IP addresses that would be used by the employees and the whitelisting of the prominent IP
addresses would help in the organisation to implement the defence against the memcached
attacks. The mitigation of the memcrashed attacks is executed in stages. The first stage
involves the detection of the attack for identifying the normal conditions for the memcrashed
attack by the defining of the traffic patterns. After the detection of the possible attack, the
next stage involves the filtering of the traffic in the cache servers.
Analysis of future importance of this exploit
This kind of attack could impact severely on the organisations as it is a kind of DDoS
attack and it damages the servers of the organisation. This could lead to the theft of sensitive
data of the organisation. It could be used to obtain any information from the hackers if they
have stolen sensitive data from the organisations.

8
MEMCRASHED VULNERABILITY
Conclusion
Therefore, it can be concluded that the memcrashed attack is an important threat that
is faced by the organisations and it has to be properly mitigated for ensuring the security of
the organisation. Any key-value database is the paradigm of data storage that is designed for
the storage, retrieval, and management of the associative arrays, any data structure that is
popularly known as the hash table or dictionary. The dictionaries comprises of the collection
of records or objects that contains fields in them and each comprising of data. The storing and
the retrieval of the records is done using any key that uniquely identifies the records, and it is
utilised for the easy finding of the data in the database. The aspect of Memcached is the
commonly used distributed system of memory caching. It is commonly utilised for the
speeding up the websites that are driven by the dynamic databases by the caching of the data
and the objects in the RAM for reducing the number of the times any reading of the external
source of data has to be done. This systems utilises the architecture of client server. The
cybercriminals have discovered a method for abusing the vastly utilised Memcached servers
for launching significantly huge DDoS attacks which is greater than the unique strength that
could lead to the hitting down of the popular websites along with the arrangement of internet.
The mitigation technique that was applied for containing the attack is the routing of the
significant volume of the traffic to the Akamai service. The common mitigation technique
that is used for preventing the misuse of the memcached servers as the reflectors is the rate-
restricting the UDP on the source port 11211 or firewalling and blocking.

9
MEMCRASHED VULNERABILITY
References
Blott, M., Liu, L., Karras, K. and Vissers, K., 2015. Scaling out to a single-node 80Gbps
memcached server with 40terabytes of memory. In 7th {USENIX} Workshop on Hot Topics
in Storage and File Systems (HotStorage 15).
Carra, D. and Michiardi, P., 2014, June. Memory partitioning in memcached: An
experimental performance analysis. In 2014 IEEE International Conference on
Communications (ICC) (pp. 1154-1159). IEEE.
Chalamalasetti, S.R., Lim, K., Wright, M., AuYoung, A., Ranganathan, P. and Margala, M.,
2013, February. An FPGA memcached appliance. In Proceedings of the ACM/SIGDA
international symposium on Field programmable gate arrays(pp. 245-254). ACM.
Fan, B., Andersen, D.G. and Kaminsky, M., 2013. MemC3: Compact and concurrent
memcache with dumber caching and smarter hashing. In Presented as part of the 10th
{USENIX} Symposium on Networked Systems Design and Implementation ({NSDI} 13) (pp.
371-384).
Fukuda, E.S., Inoue, H., Takenaka, T., Kim, D., Sadahisa, T., Asai, T. and Motomura, M.,
2014, September. Caching memcached at reconfigurable network interface. In 2014 24th
International Conference on Field Programmable Logic and Applications (FPL) (pp. 1-6).
IEEE.
Islam, N.S., Lu, X., Wasi-ur-Rahman, M., Rajachandrasekar, R. and Panda, D.K.D., 2014,
October. In-memory i/o and replication for hdfs with memcached: Early experiences. In 2014
IEEE International Conference on Big Data (Big Data)(pp. 213-218). IEEE.
Karras, K., Blott, M. and Vissers, K., 2014. High-level synthesis case study: implementation
of a memcached server. arXiv preprint arXiv:1408.5387.

10
MEMCRASHED VULNERABILITY
Lavasani, M., Angepat, H. and Chiou, D., 2013, July. An FPGA-based in-line accelerator for
Memcached. In Hot Chips Symposium (pp. 1-23).
Lavasani, M., Angepat, H. and Chiou, D., 2014. An fpga-based in-line accelerator for
memcached. IEEE Computer Architecture Letters, 13(2), pp.57-60.
Lim, K., Meisner, D., Saidi, A.G., Ranganathan, P. and Wenisch, T.F., 2013, June. Thin
servers with smart pipes: designing SoC accelerators for memcached. In ACM SIGARCH
Computer Architecture News (Vol. 41, No. 3, pp. 36-47). ACM.
Liu, C., Ouyang, K., Chu, X., Liu, H. and Leung, Y.W., 2015, August. R-memcached: A
reliable in-memory cache system for big key-value stores. In International Conference on
Big Data Computing and Communications (pp. 243-256). Springer, Cham.
Lu, Y., Sun, H., Wang, X. and Liu, X., 2014, December. R-Memcached: a consistent cache
replication scheme with Memcached. In Proceedings of the Posters & Demos Session(pp. 29-
30). ACM.
Marathe, V.J., Seltzer, M., Byan, S. and Harris, T., 2017. Persistent memcached: Bringing
legacy code to byte-addressable persistent memory. In 9th {USENIX} Workshop on Hot
Topics in Storage and File Systems (HotStorage 17).
Ruan, W., Vyas, T., Liu, Y. and Spear, M., 2014, February. Transactionalizing legacy code:
An experience report using GCC and memcached. In ACM SIGPLAN Notices (Vol. 49, No.
4, pp. 399-412). ACM.
Shankar, D., Lu, X., Jose, J., Wasi-ur-Rahman, M., Islam, N. and Panda, D.K., 2015, March.
Can rdma benefit online data processing workloads on memcached and mysql?. In 2015
IEEE International Symposium on Performance Analysis of Systems and Software
(ISPASS) (pp. 159-160). IEEE.

11
MEMCRASHED VULNERABILITY
Soliman, A., 2013. Getting Started with Memcached. Packt Publishing Ltd.
Xu, Y., Frachtenberg, E., Jiang, S. and Paleczny, M., 2014. Characterizing facebook's
memcached workload. IEEE Internet Computing, 18(2), pp.41-49.
Zhang, W., Hwang, J., Wood, T., Ramakrishnan, K.K. and Huang, H., 2014. Load balancing
of heterogeneous workloads in memcached clusters. In 9th International Workshop on
Feedback Computing (Feedback Computing 14).