CLDAP reflection attacks generate up to 24 Gbps of traffic

Akamai researchers Jose Arteaga and Wilber Majia have identified a new Connection-less Lightweight Directory Access Protocol (CLDAP) reflection and amplification method.

CLDAP query packet

Akamai’s Security Intelligence Response Team (SIRT) has observed this attack vector producing DDoS attacks consistently exceeding 1 Gbps, comparable to DNS reflection attacks.

CLDAP

Unlike other reflection-based vectors, where compromised hosts may number in the millions, the observed CLDAP amplification factor has been able to produce significant attack bandwidth with significantly fewer hosts.

Since October 2016, Akamai has detected and mitigated a total of 50 CLDAP reflection attacks, 33 of which were single vector attacks using CLDAP reflection exclusively. A 24 Gbps attack mitigated by Akamai on January 7, 2017 is currently the largest DDoS attack using CLDAP reflection as the sole vector observed by the SIRT. The average bandwidth for these attacks has been 3 Gbps.

While gaming is typically the most targeted industry for DDoS attacks, observed CLDAP attacks have primarily targeted the software and technology industry. Other industries targeted include Internet and telecom, media and entertainment, education, retail and consumer goods, and financial services.

The largest concentration of unique CLDAP reflectors observed in attacks were located within the United States.

Target industry count for DDoS attacks containing CLDAP reflection

Mitigating CLDAP attacks

Like many other reflection and amplification attack vectors, CLDAP attacks would not be possible if organizations had proper ingress filtering in place. Potential hosts are discovered using Internet scans and filtering User Datagram Protocol (UDP) destination port 389.

Akamai observed a total of 7,629 unique CLDAP attack reflectors based on sources collected during actual CLDAP reflection attacks. The usable pool of CLDAP reflectors is larger than this number, however, as revealed by Internet scanning. Unless there is a legitimate need for an organization to have CLDAP available over the Internet, there should be no reason to compound the DDoS reflection problem by exposing this protocol. Once a server is identified as a viable source for a CLDAP reflection attack, Akamai adds it to a list of known reflectors to prevent subsequent abuse of this service.

“More than 50 percent of all attacks are consistently comprised of UDP-based reflection attacks,” explained Jose Arteaga, Security Intelligence Response Team, Akamai. “Based on similarities shared with UDP reflection attack scripts, CLDAP has likely been included, or will be included, into a full attack script, and integrated into the booter/stresser infrastructure. If it has yet to be included, we may not have seen the worst of these attacks.”