4 ms·
I see. For anyone else who doesn't have any background in this attack: memcached is an open source general purpose cache that uses sockets to cache data. From
by flafla2 9y ago
I see. For anyone else who doesn't have any background in this attack: memcached is an open source general purpose cache that uses sockets to cache data. From what I gather, the attack here was possible because Github engineers accidentally left the memcached port open. So the attackers were able to spam memcached with large requests, and memcached responds immediately with the full contents of the cached memory (assuming, of course, that the client is localhost).
> The memcache protocol was never meant to be exposed to the Internet, but there are currently more than 50,000 known vulnerable systems exposed at the time of this writing. By default, memcached listens on localhost on TCP and UDP port 11211 on most versions of Linux, but in some distributions it is configured to listen to this port on all interfaces by default.
Yikes!
- tlunter 9y agoI don't think it was GitHub's memcached instances. It was other public instances that with spoofed network requests ended up sending traffic back towards GitHub's network.
- kevinconaway 9y ago> From what I gather, the attack here was possible because Github engineers accidentally left the memcached port open. That is incorrect. The attackers made requests that were forged to have the sender IP address of Github to multiple public memcached instances. Memcached then responds back to Github instead of the attacker. This is documented in more detail in the Cloudflare vulnerability report[0] https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/ https://blog.cloudflare.com/memcrashed-major-amplification-a...
- flafla2 9y agoAh ok. This makes much more sense -- leaving a port open seems like an amateur mistake for a firm like Github. Thanks for the link.
- shuntress 9y agoIf Github had no open ports they wouldn't have much of a website.
- dc_gregory 9y agoI think it was more likely meant re. the original (incorrect) interpretation that github had left public access to memcache instances.