Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/13/2018
06:42 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

DDoS Amped Up: DNS, Memcached Attacks Rise

China and the US are the world's leading sources of distributed denial-of-service botnet attacks.

Record-breaking distributed denial-of-service (DDoS) attacks are on a tear this year, and new data shows that DNS amplification attacks have jumped 700% worldwide since 2016.

In the first quarter of 2018, some 55 DNS amplification attacks employed Memcached servers, according to Nexusguard's Q1 data. This year Memcached servers became the new darling of botnet operators looking for a way to jack up their DDoS attacks. Memcached is an open source software program used to increase server performance; designed for internal networks, it caches data in system memory.

But many organizations leave their Memcached servers with public Internet exposure; DDoS attackers are snapping them up for their dirty work because they are so powerful and provide volumetric DDoS traffic via even low bandwidth connections. Memcached can generate amplified DDoS attacks by a factor of 51,000 times other DNS amp attacks, according to Nexusguard. 

Earlier this year Githu suffered a Memcached-born DDoS attack that hit 1.35TB. But that record was broken a week later by a 1.7TB DDoS that used Memcached servers against an undisclosed US service provider.

Juniman Kasman, CTO of Nexusguard, says amplification-style DDoS attacks are here to stay. "Cyberattackers continue to seek new vulnerabilities to pursue more firepower, launching more amplification attacks through unguarded Memcached servers and poorly configured DNSSEC-enabled DNS servers the past two quarters, and we expect this trend to continue," he said in a statement.

By far, DNS amplification was the top DDoS attack in Q1, with 4,791 attacks, followed by UDP (1,806 attacks) and ICMP (1,608 attacks). 

Overall, multivector DDoS attacks that combine DNS, network time protocol (NTP), universal datagram protocol (UDP), and other protocols to amplify the attack are the most common. These attacks accounted for more than half of all DDoS botnets in the first quarter, according to the report.

China was the No. 1 source of DDoS attacks, with 15.2%, followed by the US, with 14.2%.

Related Content:

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19698
PUBLISHED: 2019-12-10
marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.