Tag: dos

If you have not already seen it, experiences it, or read about it, working to head off another reflection DOS vector. This time it is memcached on port 11211 UDP & TCP. There are active exploits using these ports. Reflection attacks and the memcached is not new. We know how reflection attacks work (send a spoofed packet to a device and have it reflected back (yes please deploy source address validation and BCP 38).

Operators are asked to review their networks and consider updating their Exploitable Port Filters (Infrastructure ACLs) to track or block UDP/TCP port 11211 for all ingress and egress traffic. If you do not know about iACLs or Explorable port filters, you can use this white paper details and examples from peers on Exploitable Port Filters:

http://www.senki.org/operators-security-toolkit/filtering-exploitable-ports-and-minimizing-risk-to-and-from-your-customers/

Enterprises are also asked to update their iACLs, Exploitable Port Filters, and Firewalls to track or block UDP/TCP port 11211 for all ingress and egress traffic.

Deploying these filters will help protect your network, your organization, your customers, and the Internet.

This should help protect you if you add this to your firewall.

# new port 11211 DoS
/sbin/iptables -t filter -I INPUT -s 0.0.0.0/0 -p tcp --dport 11211 -j DROP
/sbin/iptables -t filter -I OUTPUT -s 0.0.0.0/0 -p tcp --dport 11211 -j DROP
/sbin/iptables -t filter -I FORWARD -s 0.0.0.0/0 -p tcp --dport 11211 -j DROP
/sbin/iptables -t filter -I INPUT -s 0.0.0.0/0 -p udp --dport 11211 -j DROP
/sbin/iptables -t filter -I OUTPUT -s 0.0.0.0/0 -p udp --dport 11211 -j DROP
/sbin/iptables -t filter -I FORWARD -s 0.0.0.0/0 -p udp --dport 11211 -j DROP