Story image

NZ pummelled by DDoS attacks during Memcached attack outbreaks

11 Apr 18

New Zealand did not escape a massive increase in Distributed Denial of Service (DDoS) attacks that swept the world in February and March and Arbor Networks says the ‘Memcached’ vulnerabilities were to blame.

In March, New Zealand was hit by 4200 attacks, equating to 135.4 every day. In February, it was hit by 2700 attacks.

Arbor Networks’ ATLAS global internet monitoring system has visibility into a third of all internet traffic. It can identify the trends and threats happening daily, providing actionable intelligence about botnets, DDoS attacks and malware that threaten internet infrastructure and network availability.

It found that New Zealand is experiencing larger attacks, with some being 25 times larger than the average attack size compared to the same period last year.

The biggest attack against New Zealand was 62Gbps – a 19.3% increase on the previous record.

Between February and March the attacks appeared to originate from the same four countries: The United States, China, the Netherlands – and even New Zealand itself.

In February, New Zealand accounted for 28.57% of attacks and in March, that number dropped slightly to 26.17%.

The largest attack against New Zealand in February reached 74 gigabits per second (Gbps), much higher than March’s 49.4Gbps peak.

“The fact that the attack size fell significantly between February and March from 74 to 49.4 Gbps is likely due to security teams mitigating any further Memcached server related threats,” a statement from Arbor says.

February’s largest packets per second (PPS) attack reached 16.6 MPPS. PPS is the throughput of an attack that targets firewalls, IPS and load balancers, Arbor says. In March, the figure rose to 26.2MPPS.

Improperly-configured Memcached servers accounted for two of the world’s biggest record-breaking DDoS attacks that hit GitHub (1.25Tbps) and another against a US service provider (1.7Tbps).  The servers amplified the effects of the attacks.

Arbor Networks defines Memcached as an in-memory database caching system often deployed in IDC, cloud and Infrastructure-as-a-Service networks to improve performance of database-driven websites and other internet services.

Memcached should not be exposed to public internet in most cases, but there are many deployments that leave the systems open and with the default insecure configuration.

The attacks use the misconfigured servers to launch high-volume UDP reflection-amplification attacks. It does this by spoofing an IP and sending thousands of requests to a server. That host server cannot handle the requests and the process often crashes the server itself.

In some cases, a request of just 15 bytes triggered a response of 750kB – an amplification of 51,000 times.

Read more about Memcached servers here.

ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
Exclusive: Fileless malware driving uptake of behavioural analytics
Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).
'DerpTrolling’ faces jail time for Sony DoS attacks
A United States federal court has charged a 23-year-old man for the hacks on Sony Online Entertainment and other major companies back in 2014.
Kiwis concerned about being scammed – survey
This unease is warranted given the growing sophistication of scammers and their activities, and numbers of attempted fraud.
It's time to rethink your back-up and recovery strategy
"It is becoming apparent that legacy approaches to backup and recovery may no longer be sufficient for most organisations."
Dropbox strengthens security with raft of new partnerships
Integrations will keep customer content protected and secure with tools for controlling identity access, governing data, and managing devices.
Interview: Aruba’s NZ country manager talks channel strategy
“What we're taking to market is that message around simplification and having everything in one place.”
Companies swamped by critical vulnerabilities – Tenable
Research has found enterprises identify 870 unique vulnerabilities on internal systems every day, on average, with over 100 of them being critical.