An analysis of DRDoS amplifiers in Turkey and Europe

Denial of Service attack continue from the past to the present by increasing their effectiveness with different strategies. Distributed Reflected Denial of Service (DRDoS), also known as Amplification Attack, is the new trend in the types of service blocking attacks. Attackers typically use services that use the UDP protocol as a reflector in Distributed Reflected Denial of Service attacks. The attacker's BotNets spoof the victim's IP address and send queries to UDP-based services. The responses generated by the reflectors go to the victim, allowing the victim's service to be temporarily disabled or delivered with very large delays. In order to increase the attack efficiency in these queries made by attackers, it is generally preferred to produce large amount of response data. NTP, DNS and memcached services are some of the protocols that generate high rate response data. The power of attacks is directly proportional to the number of reflectors on the Internet. The ability to reduce attacks is indirectly in the hands of all UDP-based server administrators. Hardening known weaknesses of servers will prevent them from being used as amplifiers or reflective in attacks. Although a number of compression methods have already been established for many services currently used during DRDoS attacks, it is possible to find a large number of reflectors on the Internet. In this study, the NTP and DNS servers frequently used by attackers, as well as memcached servers, which have been used by attackers since February 2018 and which have led to the greatest volume of attacks to date, have been discovered throughout the countries, and the use of these servers as an amplifier has been investigated. Research has focused on 43 European countries. As a result of this study conducted in 43 countries, it was determined that the awareness of hardening in server administration between countries can be compared. The results show that in some countries, such as Estonia, the awareness of hardening is very high, and in some countries it has shown that the opposite can happen