How a Misconfigured Memcached Server Led to the Record-Breaking DDoS Attack on GitHub

In recent times, a record-breaking Distributed Denial-of-Service (DDoS) attack was launched against the popular code repository site, GitHub, using misconfigured Memcached servers. The attack, which peaked at an astonishing 1.35 TB, has raised concerns about the potential security risks associated with exposing Memcached servers to the public internet.

According to Akamai's Prolexic DDoS mitigation service, when a Memcached server is exposed to the internet, it can be easily abused as a reflector. This is because the protocol lacks authentication, making it vulnerable to spoofed UDP traffic requests. In essence, an attacker could exploit this vulnerability by requesting large data values from the Memcached server multiple times, causing a significant amount of traffic to flood the target website.

Sammy Migues, a senior member at Synopsys Software Integrity Group, echoed similar sentiments, stating that exposing Memcached servers to the public internet is still wrong. This sentiment was also shared by Vaughan- Nichols on ZDNet, who emphasized that incompetent system administrators (sysadmins) are often responsible for exposing Memcached-enabled servers to the public internet.

The attack against GitHub highlights the significance of the current attack surface of vulnerable Memcached servers. It is crucial for system administrators and developers to understand that Memcached was never intended to be available over the public internet. The protocol's lack of authentication makes it an attractive target for attackers, who can easily exploit this vulnerability to launch DDoS attacks.

In conclusion, the recent record-breaking DDoS attack on GitHub serves as a stark reminder of the importance of proper configuration and security measures when using Memcached servers. By understanding the potential risks associated with exposing these servers to the public internet, we can work towards creating a more secure online environment for all.

Ip ddos github