DDoS Protocol Amplification Analysis

2/27/2018

This post details the discovery and analysis of a new amplification attack vector using the memcached protocol over UDP port 11211. It explains the mechanics of amplification attacks, the specific vulnerabilities in the memcached protocol that enable high amplification factors (up to 51,200x), and provides data on the scale of attacks observed (up to 260Gbps). It also maps the source IPs of vulnerable memcached servers and lists common hosting providers. Finally, it provides recommendations for memcached users, system administrators, ISPs, and developers to mitigate these attacks.

6/28/2017

This post details the analysis of a 100 Gbps+ DDoS attack leveraging the Stupidly Simple DDoS Protocol (SSDP) and UPnP. It explains how misconfigured firewalls and IP spoofing enable these amplification attacks. The post provides technical details on SSDP's M-SEARCH frames, the amplification factors achieved with 'ssdp:all' queries, and the distribution of vulnerable reflector IPs and ASNs. It also includes a Python script for querying SSDP devices and analysis of common 'Server' header values.

1/9/2017

This post details the investigation and analysis of a novel attack vector that generated millions of junk HTTP requests per second. The attack was characterized by a repeating binary payload with specific length distributions and was sourced from a globally distributed botnet that aggressively rotated IP addresses. The invalid HTTP requests bypassed traditional HTTP DDoS mitigations, requiring the use of tcpdump and payload analysis to identify the pattern and scale of the attack. The investigation identified the payload's generation algorithm and its potential connection to Keccak test vectors.

8/25/2016

This post details how the CPSC.gov DNS record is being used for DNS reflection amplification attacks, explaining the amplification factor (68x) and its popularity among attackers (94% of requests). It analyzes the CPSC.gov DNS record structure and provides recommendations for reducing its size to mitigate its use in DDoS attacks.

3/1/2016

This post details the DROWN attack, which exploits vulnerabilities in SSLv2 and the sharing of private keys across servers supporting both SSLv2 and newer TLS versions. Cloudflare automatically protects customers by not enabling SSLv2 and proactively tests customer origin servers for vulnerability. The post advises disabling SSLv2 and ensuring private keys are not shared with SSLv2-enabled servers.

1/7/2015

This post details the analysis of a specific DDoS attack against Cloudflare's DNS servers. The author investigates a correlation between the TTL field in IP headers and the IPv4 source address, discovering that the TTL is derived from the first byte of the source IP address (TTL = first byte >> 1 + 40). Additionally, the DNS ID field is found to be the one's complement of the first two bytes of the source IP, and the IPv4 header ID is the first two bytes of the source IP. The post concludes by posing a mystery about how the random source IPs are generated.

5/21/2014

This post details the historical context and technical implementation of the Berkeley Packet Filter (BPF) and its use in network packet filtering, particularly for tools like tcpdump. It explains the BPF bytecode, kernel API, and how Cloudflare utilizes custom BPF bytecode with the 'xt_bpf' iptables module for sophisticated, high-performance packet filtering to drop malicious traffic, including specific examples for DNS query filtering and subdomain matching.

2/23/2014

This post details the aftermath of a large 400Gbps NTP amplification DDoS attack on Cloudflare's network. It identifies 4,259 vulnerable NTP servers used as amplification vectors via the 'monlist' command. Encouragingly, over 75% of these vulnerable servers were no longer vulnerable within a week and a half, indicating successful community and administrator efforts to patch or reconfigure them. The post also references an earlier blog post explaining the technical details of NTP-based DDoS attacks.

2/13/2014

This post details a specific 400Gbps NTP amplification DDoS attack, analyzing its mechanics, the number and distribution of NTP servers used, and the amplification factor of the MONLIST command. It highlights the global nature of the threat and the importance of network operators restricting access to NTP servers and disabling the MONLIST command, as well as enforcing BCP38 to prevent source IP spoofing. It also foreshadows SNMP amplification attacks.

1/9/2014

This post details the mechanics of NTP-based DDoS amplification attacks, explaining how the `monlist` command can be exploited to generate large replies from small requests. It highlights the amplification factor (up to 206x observed) and the ease of finding vulnerable NTP servers. The post also provides mitigation strategies for server administrators (upgrading ntpd, disabling monlist or using mrulist with nonce) and network operators (implementing BCP-38 to prevent IP spoofing).

2/22/2013

This post details the successful effort to reduce the number of open DNS resolvers, a significant source of amplification attacks, by over 30% through engagement with network providers. It highlights the problem of DNS amplification attacks, the role of misconfigured resolvers, and the positive impact of Cloudflare's 'name-and-shame' approach in encouraging network providers to clean up their open resolvers. It also gives kudos to Team Cymru and SoftLayer for their efforts.

10/30/2012

This post details the mechanics of DNS amplification attacks, explaining how attackers leverage open DNS resolvers and UDP to magnify traffic volume. It contrasts DNS amplification with older SMURF attacks and highlights how DNSSEC, while enhancing security, can inadvertently increase the amplification factor. The post also explains Cloudflare's network architecture and bandwidth billing model as factors that make it resilient to such attacks.

8/6/2012

This post analyzes attack statistics from July 2012, identifying 'Martian IP addresses' (reserved IP ranges not valid on the public internet) as the largest source of attacks. It explains IP address spoofing and how it's used in DDoS attacks, particularly reflection attacks like DNS reflection, where small query packets are amplified into larger reply packets. The post details how Cloudflare's network team analyzes these attacks by looking at invalid networks rather than spoofed source IPs.