News for hackers. Stuff that matters.

A comment on February 28th DDoS Incident Report. Parent comment

Re:February 28th DDoS Incident Report by kevinconaway on Thursday March 01, 2018 @11:45AM (#16493560)
> From what I gather, the attack here was possible because Github engineers accidentally left the memcached port open.

That is incorrect.

The attackers made requests that were forged to have the sender IP address of Github to multiple public memcached instances. Memcached then responds back to Github instead of the attacker.

This is documented in more detail in the Cloudflare vulnerability report[0]

https://blog.cloudflare.com/memcrashed-major-amplification-a...

[ Parent | on HN ]
Re:February 28th DDoS Incident Report by flafla2 on Thursday March 01, 2018 @11:51AM (#16493620)
Ah ok. This makes much more sense -- leaving a port open seems like an amateur mistake for a firm like Github. Thanks for the link.
[ Parent | on HN ]
Re:February 28th DDoS Incident Report by shuntress on Thursday March 01, 2018 @01:54PM (#16494951)
If Github had no open ports they wouldn't have much of a website.
[ Parent | on HN ]
Re:February 28th DDoS Incident Report by dc_gregory on Thursday March 01, 2018 @09:56PM (#16498593)
I think it was more likely meant re. the original (incorrect) interpretation that github had left public access to memcache instances.
[ Parent | on HN ]