A new DDoS attack vector that leverages Lightweight Directory Access Protocol (LDAP) for reflection-amplification attacks was reported in October 2016 by Corero Network Security. Reflection-amplification attacks are not a new DDoS trend, but new attack vectors emerge all the time. Attackers continue to exploit decades-old protocols in an effort to achieve stronger amplification, enabling them to inflict greater damage.
How It Works
As with any reflection-amplification DDoS attack, three players are involved: the attacker, the unwitting “victim” server, and the attacker’s target. The attacker sends small requests to a publicly available “amplifying” server—in this case, an LDAP server—in order to produce large (amplified) replies, reflected to a target server. The attacker spoofs (changes) the source IP address so that the request appears to have originated from the target, thereby making the LDAP server “reply” to the target. To increase attack efficiency, the attacker usually selects the queries that will yield the largest replies in order to amplify the attack strength.

Figure 1: How an LDAP reflection-amplification attack works
LDAP's Weak Spot
LDAP is used to query resources such as networks, systems, applications, and services throughout an organization network. This protocol is typically served over TCP, which requires a connection to be established before data is transferred. But, in this case, because the source IP address is spoofed and a connection cannot be established, the attacker must use a connectionless protocol like UDP in order for a reflection attack to work.
Conveniently, LDAP also supports communicating over UDP—a connectionless protocol—using port 389 by default. Thus, any publicly available LDAP server that uses UDP port 389 could be a great amplifier for serving this attack because LDAP over UDP lets some unauthenticated queries right through.
In researching this attack vector, one of our first questions was whether there were organizations that actually enabled LDAP authentication publicly. The answer was, unfortunately, yes.
Global Scope of Vulnerable LDAP Servers
Attackers typically use network scanners to look for publically open ports on selected IP addresses. These scanning tools are relatively simple to set up, even for someone with limited technical skills. A simple installation process and a few command line entries are all that’s required.
What’s more, it’s simple for just about anyone to use the Shodan search engine to find vulnerable LDAP servers. At the time of this writing, Shodan reported 1,984 vulnerable LDAP servers globally.