Comprehensive Report: Analyzing Memcached Vulnerabilities & Solutions

This report provides a comprehensive analysis of Memcached, an open-source distributed memory object caching system, detailing its working principles, uses, and vulnerabilities. It explores the structure of Memcached, including keys, expiry times, and data, and discusses its role in reducing database load for dynamic web applications. The report delves into key-value databases, their data storage methods, and examples of their application in various scenarios. A significant portion of the report focuses on the 'Memcrashed' exploit, describing how attackers leverage UDP packets and IP spoofing to amplify DDoS attacks, and it offers several solutions to mitigate these vulnerabilities, including hardening Memcached configurations, disabling UDP, preventing IP spoofing, and implementing firewall protection. The report concludes by emphasizing the importance of these security measures in maintaining the robustness and availability of Memcached-dependent systems, highlighting the need for ongoing vigilance and proactive defense strategies against evolving cyber threats. Desklib provides access to this and many more solved assignments for students.

Running Head:VULNERABILITIES RELATED TO MEMCACHED
VULNERABILITIES RELATED TO MEMCACHED
Name of the Student
Name of the University
Author Note

1VULNERABILITIES RELATED TO MEMCACHED
Executive Summary
This report aims at providing a clear understanding of the working principle of Memcached
and what are its uses. The report provided a clear idea regarding the data-value database, its
uses and also provides some simple examples related to key-value database. Vulnerability
related to memcached and solutions are also provided.

2VULNERABILITIES RELATED TO MEMCACHED
Table of Contents
Introduction....................................................................................................................3
Discussion......................................................................................................................4
Working of Memcached.............................................................................................4
Uses of Memcached...................................................................................................5
Key-Value Database...................................................................................................5
Type of Data stored in Key-Value Database..............................................................5
Examples that are related to Key-value Stores..........................................................6
Solution for memcrashed solution.................................................................................8
Analysis on future importance and effectiveness of memcrashed...............................11
Conclusion....................................................................................................................13
References....................................................................................................................14

3VULNERABILITIES RELATED TO MEMCACHED
Introduction
Memcached is an open source, memory distributed object caching system that reduces
the load on database to increase the speed of dynamic Web applications. The work of the
system is to catch objects and data inside the memory to reduce the by which external
database of application program interface can be accessed. Memcached system comprised of
keys, time of expiry, raw information and flags that are optional. If an item sends a request,
Memcached first of all checks the expiration time to check whether the item is still valid or
not before it returns back to the server. Memcached basically consist of four fundamental
components that are fundamental. It consist of client software, which is used to receive a list
of Memcached servers that are available. It consist of a hashing algorithm that is client-based
that is used to choose a server on the basis of key input. Memcached also consist of server
software, which is used to store values with keys into the internal hash table. The server
software in memcached is used to determine when to reuse the memory and when to use the
old data. Memcached is used in different platform which includes Bego , Digg , Type pad and
in YouTube as well. The report focuses on the discussion related to vulnerability related to
memcached. The working principle of Memcached and the way it is used is also provided in
detailed in the entire report. This report also provide discussion related to key/value database.
The report also provide discussion related to the future importance and effectiveness of
memcrashed. After the analysis of the report the user will be able to analyse the potential
threat to computer system and networks and also will be able to evaluate the threat. The
report analysis the security policies and techniques as well.

4VULNERABILITIES RELATED TO MEMCACHED
Discussion
Working of Memcached
Memcached basically comprises of four major components and the components
allows in storing and retrieving of information. Each of the items comprises of keys, time of
expiry and collection of raw data (Berezecki et al. 2011).
The working principle follows the following steps.
First of all check whether the data exist in the cache. If the cache records, then
retrieve the information and the need for querying the database does not exist (O’Hare 2018).
If the information or data is not available in the cache, then send query to database.
After that return the essential information to the script and then store the data into the cache.
Keeping the cache fresh, whenever there is a change then perform the action of
updating the data in the cache. When the cache is queried for the information then it should
perform the action of redirecting of data to the database or else provide the updated data.
The figure provided below gives a pictorial representation of the above mentioned
working principle of memcached.

5VULNERABILITIES RELATED TO MEMCACHED
Uses of Memcached
Memcached performs the job of load reduction by storing data objects in the dynamic
memory. Memcached also performs the work of storing of data based on key-values for
arbitrary strings or objects that are small in nature. The main advantage of using memcached
is by speeding up of dynamic wed applications by reduction of database load. Memcached
also reduces the input output accesses as most of the data is stored in Random Access
memory of the machines which provides a great help to speed up the application (Carra and
Michiardi 2016). Another advantage of memcached is that the user has the access to allocate
the RAM that memcached can use for further process. If the implementation is done in
correct fashion, this decreases the data traffic enormously that is close to around 95% and as
a result can speeds up the web shop. Memcached is also advantageous because memcached
performs the work of hiding of data from the cache to the cluster. Memcached has also
availability in different languages such a Java and C++ and many order programming
languages.
Key-Value Database
Key-Value Database is basically a simple hash table. It is basically a type of NoSQL
database that uses a simple technique to store information. Key-value is a type of database
that stores data in the form of key or value pairs (Pavlo et al. 2017). It is beneficial for many
programming languages Programming language is related to key-value as an associative
array or data structure.
Type of Data stored in Key-Value Database
Key that is used in key-value store must be unique. The unique key can be considered
as a unique identifier that allows accessing of values with the key. The unique key can be
anything but it mainly depend on DBMS (Sengupta, Debnath and Li. 2017).

6VULNERABILITIES RELATED TO MEMCACHED
Values in key-value can be text, number, image and others as well. Some key-store
allows DBMS to specify a type of data for the value.
Key- value Database can be applied to many cases. Key-value stores is used for
storing items that are mentioned below.
General Web such as user profile, emails, session information and article comments
(Shams et al. 2017).
Ecommerce such as Shopping cart contents, details of the product, reviews related to
product and different categories of product (Talagala et al 2015).
Key-Value databases can even store the whole webpages by the use of the URL as a
key and web pages as values.
It is used to store network or data maintenance such as Telecom directories, Internet
Protocol (IP) tables for forwarding (Wu and Wu 2018).
Examples that are related to Key-value Stores
Directories of phone
Keys Values or data
Rahul [phone]
Shyam [phone]
Rohit [phone]
Abbas [phone]

7VULNERABILITIES RELATED TO MEMCACHED
Information of Artist
Keys Values
Name of artist1 DP
Name of artist2 Indus
Name of artist4 Racks
Name of artist6 State
The above examples illustrates that key-value is using for storing of data so it is known as
key-value store.
Description of Memcrash Exploits
Distributed Denial of Services attacks have been increasing in a very fast rate. This
increase in the terminology of the Distributed Denial of Service includes blasting of the sites
as per the trafficking of the terabytes. Object coaching program is highly benefited from the
open source technology that is present in the Memcached terminology. Storing of data in
junks are the major concern of the key value management of the arbitrary data. Reflection
attack vector is considered as the major issue that affects the public interest. The availability
of Memcache in public platform is comparatively less. During the data receiving process, a
request is made that calls the memcache. This is one of the major reason that collection of the
request can be made as per the management of the memory that is fetched from the response
set. Enhancement of the uninterrupted streams are one of the main aspect that will be taken
into consideration. This ensures the fact that the management of the project will get
performed with least efficiency. UDP packets are introduced in the networking system. The
length of the packet that is introduced in the system is 1400 bytes. The imposters introduces
the data in the server. The fixed value that is stored in the server is 1 MB. The data that will

8VULNERABILITIES RELATED TO MEMCACHED
be stored in the system will be having larger values. This insists the fact that the introduction
value can be as large as possible and the imposters could impose higher amount of data that
will be blocking the entire processing of the server. The aspect that the amount of data that
will be introduced is completely dependent on the imposter himself hence the control over the
attack will also be in the hands of the attackers. The attacker can use the UDP packet process
for sending of data. This includes the fact that more that more than the attacker cab send
several files that are of 1 MB. This issue will lead to overloading of the user with data. This
overloading of the data will be having a negative effect on the users of the server. The sole
way ti stay protected from this issue is by closing the port. Implementation of the DDoS
mitigate service in the server system will help the business organization in increasing the
robustness of the server. The total number if attacks have been increasing and this is the main
reason that the projection of the process gets hampered as per the completion of the project.
The port that is used in attacking of the memcache process includes 11211 port. This
attacking is performed by spoofing of the IP address. The attack amplification has been
comparatively high.
Solution for memcrashed solution
Memcrashed solutions are of having following given below are the basic and must
needed to avoid memcrashed situation and keep the system safe from this attacks. All this
having a different roles and all are independent from each other but they must be considered
all in order to get out of memcrashed situation. Although this are not the solutions that will
make the system completely out of attacks but this will make these attacks very rare or almost
free from this attack. UDP disabling, prevention of IP spoofing, Memcached servers firewall
and Reduced UDP response software development these are the four major steps to avoid
memcrashed situation (Ghiëtte and Doerr, 2018).
The solution measures that are taken in consideration are as follows: -

9VULNERABILITIES RELATED TO MEMCACHED
1. Hardening of the memcached: The most popular and efficient platform that is used for
the mitigation of the memcached system is SANS (Izraelevitz et al 2019). With the
help of the usage of the SANS, hardening of the memcache must be performed. For
hardening of the memcache platform the firs step that is to be taken includes opening
of the memcached.conf. Text editor is the job that is assigned to the SANS platform.
Understanding of the specification of the text editor is important. Hence the
management process revolves around the SANS platform. Tracing of the location of
the m parameter is also an important factor. Modulation of the data processing is one
of the major advantage that is gained with the help of the SANS platform (Richter et
al 2019). Detection of one parameter changing is required. This includes the aspect
that the management of the project will provide better management of the parameter
detection. Changing of the value of the local host server to 127.0.0 is a method that
will help in increasing of the hardening of the platform. With the help of the changing
value of the local host server to 127.0.0, a change in the text editor can be performed.
Restarting of the memached will be providing efficiency in the process (Shankar et al
2016).
2. Disabling of the UDP: Disabling of the UDP will be beneficial in the commencement
of the project. Setting of strict packet size is one of the major reason that the
functioning of the project will get influenced with the packet size. This is one of the
major reason that developer have been using the functioning of the UDP (Carra and
Michiardi 2016). Having a proper and strict packet size, reduction in the processing of
the attack can be obtained. This aspect will increase the robustness of the entire
section. Closing of the port that is viable is projected as per the management of the
project. By restricting the size of the packet increase in robustness of the system will
get increased and hence better security process can be implemented. Akamai is one of

10VULNERABILITIES RELATED TO MEMCACHED
the tool that is used for disabling of the support of the entire system. In case the ports
that are vulnerable are kept open, data getting attacked will be a major issue. This is
one of the major reason that commencement of the project must be performed after
closing of the vulnerable ports. The detected vulnerable port is 11211 (Hafeez et al
2016). There is another solution for this memcached and that is, removing the
amplification factor for incoming requests as the response data that will be sent as a
result of UDP request is lower than or level to starting request, then the amplification
will not be possible. By default memcached has enabled user datagram protocol so
make sure to disable its UDP support for memcached server it is not needed. Leaving
this as default settings will make server vulnerable (Eggert et al, 2017).
3. Redundancy building: Using of the load balancing will be beneficial in the processing
of the entire system. This includes the fact that the management of load balancing will
affect the redundancy of the project in a positive manner. Distribution of the data in
different databases are one of the main advantages that are enjoyed after deploying of
the load balancing. Ensuring that there are no loop holes present are one of the major
aspect that must be taken into consideration (Shankar et al 2016). With the help of
proper analysis of the data that are present the main advantages that will be present
includes better data management and hence completion of the project will get
performed in a better manner. This aspect will also ensure that the attackers will not
be able to attack the server.
4. Prevention of IP spoofing: (Booth and Andersson, 2015) Distributed Daniel of
services (DDos) attacks uses IP address and if the IP address can be spoofed then this
will make the system vulnerable directly traffic to the victims system (Shurman et al,
2016). Making IP address free from spoofing is one of the largest solution for the
memcrashed and it cannot be implemented from any administrator particularly and

11VULNERABILITIES RELATED TO MEMCACHED
needs providers transit to not to allow leaving any packets from their network that
contains IP addresses to originate outside. In other word it can be said that, companies
that provides IPs (internet service providers) they must perform filter in such a way
that the packets leaving their networks should not be allowed to prevent to be coming
from somewhere else network. If this system spoofing free gets implemented then the
attackers based on spoofing will be eliminated easily (Osanaiye, 2015).
5. Memcached servers firewall: System administrators will be able to use UDP for
memcached if they firewall memcached and if it is necessary without any exposure.
6. Reduced UDP response software development: Apart from this four ways, if the
requirement of UDP support is needed, again consider the need of services to be
world reachable to the user that might unwittingly be taking place for amplification
attack. If the user datagram protocol did not have enabled ant the system us having
public accessible to Memcached services, this should be public only if it is needed
mostly, otherwise there is no need to overexpose the network. Making this things
private is very much important to secure the network and keep the system away from
memcached attack. If any of the mention point is missing from the system then there
is very easy way for the attacker and for the system to get memcached attack as these
are the very basic and must needed steps to follow.
Analysis on future importance and effectiveness of memcrashed
Distributed Daniel of Service attack are not there new but the increment of popularity
of uncontrolled services of cloud and the internet of things tools are making to more easier to
launch quickly in large amount attacks and the previous. Response of threats like this major
attack must be whole internet community one. All open domain name system (DNS) resolver
(Jones, B., Feamster et al, 2016), all internet of things devices, all UDP service that are
exposed similar to memcached must be identified and the access must be restricted.

12VULNERABILITIES RELATED TO MEMCACHED
Protection from such kind of attacks and foundation of effective security aspect is clarity and
knowledge of one’s architecture enterprise. The biggest, hybrid, divided nature of latest
enterprises construct it more difficult to know that what is stored within them. There are
many organizations who have vulnerable services accessible to the internet, and it is not
constructed best practices to identify and reject traffic spoofed.
Real-time, regular monitoring grants an instant response over the initial stages of
memcrashed or different reflective Distributed Daniel of services (DDos) charge to stop as
earliest as possible. Protecting this two, all internet community and the intended destination
of the attack and every internet members and its community (Reddy et al, 2018).
User datagram protocol attacks take advantage of the missing connection
aspect of user datagram protocol traffic. As both the receiver and sender do not to execute to
the connection in both direction. Bad actors gets advantage of this this permission to
weaponize many of the internet facing services by requests of attack. By maximizing the
bandwidth amplification factors, attackers makes out of weaponized services by the help of
crafting spoofed request. In other words it can be said that to maximize target amount of
response the traffic out of the lowest quantity of traffic the bad actors need to start. Domain
name system has 28-54 bandwidth amplification factor, whereas memcache has 10,000-
51,000 bandwidth amplification factor.
The application of memcached in user space is very clearly tuned and provides very
small scope for more optimization. Memcached also offers various number of opportunities
in the network and kernel parts and its components. The operating system and the kernel
driver is optimized for memcached likely to provide high gain in performance. Making banks
disabled with internet will give benefits in performance when the large packets comes at the
server per second are high. Memcached has made a very deep effect in the internet service to

13VULNERABILITIES RELATED TO MEMCACHED
provide a better feature and security to the web services. Memcache can be used to make
future security stronger it can be merged with hadoop bigdata to make analysis of the data
and with the help of this data give the result about the threats and security issues where
exactly security gets compromised (Anuradha, 2015). As the hadoop data analytical tools is
yet to be improved and giving this improvement in hadoop analytical tool will give and
improved memcache system. In the social media such as Facebook, Instagram etc. it is
making a big impact to provide a better experience and improved security for their users.
Conclusion
In the whole report the discussion was related to working principle of memcached and
its uses. The report also discusses about the memcrashed exploit and the solution related to
this exploitation is also provided. After the analysis of the whole report the conclusion comes
out that vulnerability related to memcrashed has proved to be a great threat in the world of
cyber security but if proper steps are taken then definitely the problems related to memcached
vulnerability can be resolved.

14VULNERABILITIES RELATED TO MEMCACHED
References
Anuradha, J., 2015. A brief introduction on Big Data 5Vs characteristics and Hadoop
technology. Procedia computer science, 48, pp.319-324.
Berezecki, M., Frachtenberg, E., Paleczny, M. and Steele, K., 2011, July. Many-core key-
value store. In 2011 International Green Computing Conference and Workshops (pp. 1-8).
IEEE.
Booth, T. and Andersson, K., 2015. Network security of internet services: eliminate DDoS
reflection amplification attacks. Journal of Internet Services and Information Security
(JISIS), 5(3), pp.58-79.
Carra, D. and Michiardi, P., 2016. Memory Partitioning and Management in
Memcached. IEEE Transactions on Services Computing.
Carra, D. and Michiardi, P., 2016. Memory Partitioning and Management in
Memcached. IEEE Transactions on Services Computing.
Eggert, L., Fairhurst, G. and Shepherd, G., 2017. UDP usage guidelines (No. RFC 8085).
Ghiëtte, V. and Doerr, C., 2018, August. How Media Reports Trigger Copycats: An Analysis
of the Brewing of the Largest Packet Storm to Date. In Proceedings of the 2018 Workshop on
Traffic Measurements for Cybersecurity (pp. 8-13). ACM.
Hafeez, U.U., Male, D., Naeni, S.K., Wajahat, M. and Gandhi, A., 2017. Realizing an Elastic
Memcached via Cached Data Migration. Restoration, 23(24), p.25.
Izraelevitz, J., Yang, J., Zhang, L., Kim, J., Liu, X., Memaripour, A., Soh, Y.J., Wang, Z.,
Xu, Y., Dulloor, S.R. and Zhao, J., 2019. Basic Performance Measurements of the Intel
Optane DC Persistent Memory Module. arXiv preprint arXiv:1903.05714.

15VULNERABILITIES RELATED TO MEMCACHED
Jones, B., Feamster, N., Paxson, V., Weaver, N. and Allman, M., 2016, March. Detecting
DNS root manipulation. In International Conference on Passive and Active Network
Measurement (pp. 276-288). Springer, Cham.
O’Hare, J., 2018. Scout: A Contactless ‘Active’Reconnaissance Known Vulnerability
Assessment Tool.
Osanaiye, O.A., 2015, February. Short Paper: IP spoofing detection for preventing DDoS
attack in Cloud Computing. In 2015 18th International Conference on Intelligence in Next
Generation Networks (pp. 139-141). IEEE.
Pavlo, A., Angulo, G., Arulraj, J., Lin, H., Lin, J., Ma, L., Menon, P., Mowry, T.C., Perron,
M., Quah, I. and Santurkar, S., 2017. Self-Driving Database Management Systems.
In CIDR (Vol. 4, p. 1).
Reddy, K.T., Wing, D.G., Andreasen, F.S. and Geller, M.D., Cisco Technology Inc,
2018. Inter-domain distributed denial of service threat signaling. U.S. Patent Application
15/297,241.
Richter, A., Herber, C., Wallentowitz, S., Wild, T. and Herkersdorf, A., 2015, June. A
hardware/software approach for mitigating performance interference effects in virtualized
environments using SR-IOV. In 2015 IEEE 8th International Conference on Cloud
Computing (pp. 950-957). IEEE.
Sengupta, S., Debnath, B.K. and Li, J., Microsoft Technology Licensing LLC, 2016. Flash
memory cache including for use with persistent key-value store. U.S. Patent 9,436,596.
Shams, K.S., Pandey, P., Sivasubramanian, S., Zaki, O.A., Yanacek, D.C., Olson, J.S., De
Kock, H.J. and Wu, J.Y., Amazon Technologies Inc, 2017. Local key-value database
synchronization. U.S. Patent 9,703,814.

16VULNERABILITIES RELATED TO MEMCACHED
Shankar, D., Lu, X., Islam, N., Wasi-Ur-Rahman, M. and Panda, D.K., 2016, May. High-
performance hybrid key-value store on modern clusters with RDMA interconnects and SSDs:
non-blocking extensions, designs, and benefits. In 2016 IEEE International Parallel and
Distributed Processing Symposium (IPDPS) (pp. 393-402). IEEE.
Shankar, D., Lu, X., Jose, J., Wasi-ur-Rahman, M., Islam, N. and Panda, D.K., 2015, March.
Can rdma benefit online data processing workloads on memcached and mysql?. In 2015
IEEE International Symposium on Performance Analysis of Systems and Software
(ISPASS) (pp. 159-160). IEEE.
Shurman, M.M., Al-Mistarihi, M.F. and Darabkh, K., 2016. Dynamic distribution of
security keys and IP addresses coalition protocol for mobile ad hoc
networks. automatika, 57(4), pp.1020-1034.
Talagala, N., Sundararaman, S., Ramsundar, B. and Batwara, A., SanDisk Technologies
LLC, 2015. Non-volatile key-value store. U.S. Patent 9,075,710.
Wu, X. and Wu, G., Intel Corporation, 2018. Memcached systems having local caches. U.S.
Patent Application 14/911,353.