An Analysis DRDoS Amplifiers in Europe

Abstract

DRDoS is the new method of choice for denial of service attacks: Certain services running over UDP is chosen for the attack. Servers across the Internet are contacted by bots with the spoofed IP address of the victim host. In response, huge amounts of response data created by the servers are sent to the victim, temporarily disabling it. The most commonly exploited protocols are those that yield the highest "amplification factor", including NTP, DNS, and Memcached. Mitigation of these attacks can be done simply by hardening servers against known vulnerabilities. However, in practice, there are many servers that lag behind. In this study, we carried out a regional analysis of NTP, DNS, and Memcached servers in Europe, and assessed their readiness against being used as amplifiers in DRDoS attacks