40. DoS and DDoS – Availability Attacks
40.4 Amplification and Reflection – Closed Lab Only
Reflection: attacker spoofs victim IP as source; open server replies to the victim. Amplification (प्रवर्धन): tiny query → huge response (DNS, NTP, Memcached historically abused when mis-exposed).
Public lesson (GitHub 2018 era): Memcached UDP on internet + spoofing = enormous reflected flood. You must NEVER scan public Memcached/NTP/DNS for amp, NEVER spoof against third parties.
Blue hygiene:
- Do not expose Memcached / open recursive DNS / insecure NTP to the whole internet
- UDP services bind to private IPs / VPC only
- Providers filter spoofed egress (BCP38 theme)
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Spoofs victim IP; queries open amplifiers | Anti-spoof egress; shut open resolvers; block UDP 11211 inbound from internet |
| Hopes SME leaves lab Memcached on 0.0.0.0:11211 | Security group / firewalld: private only; ss -ulnp audit |
| Uses amp for "anonymous" volume | Scrubbing centre recognises amp signatures; source is reflected servers |
Ravindra Bagale's Tip
Students say "let me try Memcached amplification in the lab" and leave the network bridged – a neighbour's PC will get hit too. Amplification demos, if the trainer allows them, only on an air-gapped / host-only pair of VMs. Default advice: study theory + GitHub postmortem, don't build amp. Now let's move on.
Ravindra Bagale's Tip – मराठी
Students "lab मध्ये Memcached amp try" म्हणतात आणि network bridged ठेवतात – शेजाऱ्याचा PC पण hit होईल. Amplification demos, trainer ने परवानगी दिली तरच, फक्त air-gapped / host-only VMs च्या जोडीवर. Default advice: study theory + GitHub postmortem, don't build amp. आता पुढे जाऊया.
Ravindra Bagale's Tip – हिंदी
Students "lab में Memcached amp try" कहते हैं और network bridged छोड़ देते हैं – पड़ोसी का PC भी hit होगा. Amplification demos, trainer इजाज़त दे तभी, सिर्फ़ air-gapped / host-only VMs की जोड़ी पर. Default advice: study theory + GitHub postmortem, don't build amp. अब आगे चलते हैं.
Practice task
Write 10-line hardening note for fictional Raja-Rani Traders: list UDP services they run (DNS internal? Memcached for PHP?). For each: bind address, firewall rule, "internet-facing? NO". Cite why GitHub-class amp matters to SMEs who accidentally expose cache.
Real incident: GitHub Memcached DDoS (2018)
On 28 February 2018, GitHub reported a memcached UDP amplification DDoS that peaked at a reported 1.35 Tbps and about 126.9 million packets per second, originating across many ASNs and endpoints. GitHub mitigated by shifting traffic to Akamai Prolexic scrubbing. Weakness theme: memcached instances reachable on the public internet with UDP enabled; spoofed queries produce huge replies toward the victim. Defence: never expose memcached to the internet; UDP service lockdown; scrubbing / Anycast capacity. Source: GitHub Blog "February 28th DDoS Incident Report" (verify).