“ When a system receives a memcached get request, it forms a response by collecting the requested values from memory, sending them over the wire in an uninterrupted stream. Per Akamai‘s blog post on the recently discovered attack, it is difficult to determine the exact amplification factor: In a typical DNS-based amplification attack, you would see amplification factors for around 100, whereas with reflection from a memcache server, you would see a factor of over 50,000. The key difference is the amplification power that memcached provides.

The attack is like other known DDoS reflection and amplification attacks, such as DNS, TFTP, LDAP, SNMP, BitTorrent, and others. This specific reflection attack uses memcached to amplify packet sizes in order to flood the target site with data. The attacker will trigger a UDP service to send a large amount of data to the victim, with only a small packet being sent by the attacker. Amplification attacks take the reflection attack a step further. Reflection attacks use spoofed UDP traffic from a server that is hosting the exploited service, to force sending data to an unsuspecting victim(s). What caused these most recent attacks? Was this another botnet attack?Ī day before the attack, Akamai (Intelligent DDoS and Cloud Mitigation service) discovered a new DDoS reflection attack vector involving a network tool called memcached. The previous largest recorded attack took place in 2016 when the Mirai Botnet launched a 1.2 Tbps DDoS against DYN DNS, bringing down their site, and much of the internet along with it. On Wednesday, GitHub survived the largest DDoS attack to date, with the traffic at about 1.3 Tbps (Terabits per second).

Ip ddos github