sb-nz logo
Story image

NZ pummelled by DDoS attacks during Memcached attack outbreaks

11 Apr 2018

New Zealand did not escape a massive increase in Distributed Denial of Service (DDoS) attacks that swept the world in February and March and Arbor Networks says the ‘Memcached’ vulnerabilities were to blame.

In March, New Zealand was hit by 4200 attacks, equating to 135.4 every day. In February, it was hit by 2700 attacks.

Arbor Networks’ ATLAS global internet monitoring system has visibility into a third of all internet traffic. It can identify the trends and threats happening daily, providing actionable intelligence about botnets, DDoS attacks and malware that threaten internet infrastructure and network availability.

It found that New Zealand is experiencing larger attacks, with some being 25 times larger than the average attack size compared to the same period last year.

The biggest attack against New Zealand was 62Gbps – a 19.3% increase on the previous record.

Between February and March the attacks appeared to originate from the same four countries: The United States, China, the Netherlands – and even New Zealand itself.

In February, New Zealand accounted for 28.57% of attacks and in March, that number dropped slightly to 26.17%.

The largest attack against New Zealand in February reached 74 gigabits per second (Gbps), much higher than March’s 49.4Gbps peak.

“The fact that the attack size fell significantly between February and March from 74 to 49.4 Gbps is likely due to security teams mitigating any further Memcached server related threats,” a statement from Arbor says.

February’s largest packets per second (PPS) attack reached 16.6 MPPS. PPS is the throughput of an attack that targets firewalls, IPS and load balancers, Arbor says. In March, the figure rose to 26.2MPPS.

Improperly-configured Memcached servers accounted for two of the world’s biggest record-breaking DDoS attacks that hit GitHub (1.25Tbps) and another against a US service provider (1.7Tbps).  The servers amplified the effects of the attacks.

Arbor Networks defines Memcached as an in-memory database caching system often deployed in IDC, cloud and Infrastructure-as-a-Service networks to improve performance of database-driven websites and other internet services.

Memcached should not be exposed to public internet in most cases, but there are many deployments that leave the systems open and with the default insecure configuration.

The attacks use the misconfigured servers to launch high-volume UDP reflection-amplification attacks. It does this by spoofing an IP and sending thousands of requests to a server. That host server cannot handle the requests and the process often crashes the server itself.

In some cases, a request of just 15 bytes triggered a response of 750kB – an amplification of 51,000 times.

Read more about Memcached servers here.

Story image
Holistic web protection market to reach $3.63bn by 2025
Retail, banking and technology sectors are driving the global holistic web protection market, according to new findings from Frost and Sullivan. More
Story image
LogRhythm buys out MistNet to bolster analytics capabilities
LogRhythm says its aim is to bring stronger levels of machine learning-based detection and response.More
Story image
IronNet expands Asia Pacific presence with new strategic partnership
“The combination of M.Tech’s extensive network in Asia Pacific and our unparalleled expertise in threat intelligence and detection will help more enterprises across the region to proactively identify and take down known and unknown threats before they happen.”More
Story image
Cybercriminals leverage AI to sustain attacks on enterprises
What is less discussed is how cybercriminals are taking advantage of those very same technologies to automate their attacks, too.More
Story image
Palo Alto Networks advances attack surface management with Expanse
"By integrating Expanse's attack surface management capabilities into Cortex after closing, we will be able to offer the first solution that combines the outside view of an organisation's attack surface with an inside view to proactively address all security threats."More
Story image
CompTIA forms Cybersecurity Advisory Council, led by 16 security execs
The new body will be co-chaired by Tech Data director of security solutions Tracy Holtz, and Alvaka Networks chief operating officer and chief information security officer Kevin McDonald.More