Databases & cachesTCP/UDP 11211 Cleartext by default
Port 11211: Memcached
Memcached
In-memory cache with no authentication by default.
How attackers abuse it
- UDP reflection with enormous amplification, behind some of the largest recorded DDoS attacks.
How to defend it
- Disable UDP; bind to localhost or private networks.
Exam tip
Amplification attacks need a UDP service that returns far more data than it receives - memcached, DNS, NTP, SSDP.