Memcrashed - Major amplification attacks from UDP port 11211
Feb 27, 2018Marek Majkowski
Summary
This post details a newly discovered and significant amplification attack vector using the memcached protocol over UDP port 11211. It explains the mechanics of such attacks, highlights the massive bandwidth generated (up to 260Gbps observed), identifies common sources of vulnerable memcached servers (OVH, Digital Ocean, Sakura), and provides actionable advice for memcached users, system administrators, and ISPs to mitigate these threats. It also emphasizes the ongoing challenge of IP spoofing and the need for developers to be cautious with UDP protocols.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack