Memcached Memcrashed - Major amplification attacks from UDP port 11211

Centmin Mod CSF or non-Centmin Mod ? memcached listening on localhost/127.0.0.1 ? or not ? If listening locally then it isn't possible for the memcached server to be apart of the attack AFAIK ? Probably need to ask Hivelocity for the actual proof and how they detected a publicly open memcached server. Unless they also mistakenly used nmap and saw open|filtered state and came to the wrong conclusion that the state means = open when it fact it means = closed.

---

 

DDOS attack size record has been broken with Memcrashed at 1.7Tbps DDOS Attack World's biggest DDoS attack record broken after just five days

 

thanks for heads up - but wow even worse that first though

 

curious if you ended up figuring out if memcached 11211 UDP ports were actually open or if Hivelocity's checks were mistaken ?

 

hmmm Memcached DDoS Exploit Code and List of 17,000 Vulnerable Servers Released

 

Thanks Matt seems some web hosts are just throwing everything into the Memcrashed pile. I had one web host say my cpu load was due to Memcrashed, when it was in fact the VPS running out of disk space causing load issues heh.

 

OVH write up https://www.ovh.com/ca/en/news/arti...de?xtor=ES-11-[news]-20180320-[memcached.cta]