Story image

NZ pummelled by DDoS attacks during Memcached attack outbreaks

11 Apr 18

New Zealand did not escape a massive increase in Distributed Denial of Service (DDoS) attacks that swept the world in February and March and Arbor Networks says the ‘Memcached’ vulnerabilities were to blame.

In March, New Zealand was hit by 4200 attacks, equating to 135.4 every day. In February, it was hit by 2700 attacks.

Arbor Networks’ ATLAS global internet monitoring system has visibility into a third of all internet traffic. It can identify the trends and threats happening daily, providing actionable intelligence about botnets, DDoS attacks and malware that threaten internet infrastructure and network availability.

It found that New Zealand is experiencing larger attacks, with some being 25 times larger than the average attack size compared to the same period last year.

The biggest attack against New Zealand was 62Gbps – a 19.3% increase on the previous record.

Between February and March the attacks appeared to originate from the same four countries: The United States, China, the Netherlands – and even New Zealand itself.

In February, New Zealand accounted for 28.57% of attacks and in March, that number dropped slightly to 26.17%.

The largest attack against New Zealand in February reached 74 gigabits per second (Gbps), much higher than March’s 49.4Gbps peak.

“The fact that the attack size fell significantly between February and March from 74 to 49.4 Gbps is likely due to security teams mitigating any further Memcached server related threats,” a statement from Arbor says.

February’s largest packets per second (PPS) attack reached 16.6 MPPS. PPS is the throughput of an attack that targets firewalls, IPS and load balancers, Arbor says. In March, the figure rose to 26.2MPPS.

Improperly-configured Memcached servers accounted for two of the world’s biggest record-breaking DDoS attacks that hit GitHub (1.25Tbps) and another against a US service provider (1.7Tbps).  The servers amplified the effects of the attacks.

Arbor Networks defines Memcached as an in-memory database caching system often deployed in IDC, cloud and Infrastructure-as-a-Service networks to improve performance of database-driven websites and other internet services.

Memcached should not be exposed to public internet in most cases, but there are many deployments that leave the systems open and with the default insecure configuration.

The attacks use the misconfigured servers to launch high-volume UDP reflection-amplification attacks. It does this by spoofing an IP and sending thousands of requests to a server. That host server cannot handle the requests and the process often crashes the server itself.

In some cases, a request of just 15 bytes triggered a response of 750kB – an amplification of 51,000 times.

Read more about Memcached servers here.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Updated: Chch crypto-exchange Cryptopia suffers breach
Cryptopia has reportedly experienced a security breach that has taken the entire platform offline – and resulted in ‘significant losses’.
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.