Subject: [ntpwg] Attackers use NTP reflection in huge DDoS attack

From: Yaakov Stein <[email-masked]>
Date: Thu, 13 Feb 2014 07:41:59 +0000

Attackers abused insecure Network Time Protocol servers to launch what appears to be one of the largest DDoS attacks ever reported.

See :
http://www.computerworld.com/s/article/9246230/Attackers_use_NTP_reflection_in_huge_DDoS_attack
http://www.informationweek.com/security/attacks-and-breaches/ddos-attack-hits-400-gbit-s-breaks-record/d/d-id/1113787
http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks

Y(J)S

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: "Ulrich Windl" <[email-masked]>
Date: Fri, 14 Feb 2014 09:07:57 +0100

On January 20th, I received this advisory; maybe it's helpful for anyone:
---
[...]

1) problem description, brief discussion

   The "monlist" command of the NTP protocol is currently abused in a DDoS
   reflection attack. This is done by spoofing packets from addresses to which
   the attack is directed to. The ntp installations itself are not target of
   the attack, but they are part of the DDoS network which the attacker is
   driving. It is therefore necessary to restrict ntp configurations to not
   answer spoofed "monlist" requests. It is not necessary to update the ntp
   software itself.

   Additional information can be found here:

   https://www.cert-bund.de/advisoryshort/CB-K14-0020%20UPDATE%202 
   http://www.kb.cert.org/vuls/id/348126 

   A more comprehensive description on how you can secure your
   infrastructure against NTP DDoS reflection attacks can be found here:

   http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html 

2) solution/workaround

   To ensure that your ntpd installation can not participate in a DDoS attack,
   add the following line to your configuration:

   restrict default noquery

3) special instructions and notes

   After applying the configuration changes, restart the ntp daemon.

4) package location and checksums

   not applicable

______________________________________________________________________________
[...]

Regards,
Ulrich

>>> Yaakov Stein <[email-masked]> schrieb am 13.02.2014 um 08:41 in Nachricht
<[email-masked]>:
> Attackers abused insecure Network Time Protocol servers to launch what 
> appears to be one of the largest DDoS attacks ever reported.
> 
> See :

---

From: Brian Haberman <[email-masked]>
Date: Fri, 14 Feb 2014 11:10:05 -0500

A question for the group...

Do we need to codify these (and maybe other) security guidelines in a BCP?

Brian

---

From: Danny Mayer <[email-masked]>
Date: Fri, 14 Feb 2014 21:09:51 -0500

> Do we need to codify these (and maybe other) security guidelines in

For this particular attack, I'm not so sure since they involve mode 7
packets and as far as I know only the reference implementation from
ntp.org implements them as well as mode 6 packets which are also meant
as management tools. These packets are not well documented,
particularly mode 7 and I believe only mode 6 packets are documented
in RFC 1305 which has been obsoleted by RFC 5905.

Only mode 6 and mode 7 packets could be used in an amplification
attack as all the other types return just the same size packets as the
incoming ones.

There is a general need for a BCP for NTP, partiucularly over things
like Rules of Engagement and KOD packets. Some the more well-known NTP
servers (like NIST and USNO) are overwhelmed with packets, hardware
manufacturers have hard-coded IP addresses of NTP servers, and some
software just bombards NTP servers with requests.

So I think that my answer is in general yes, but not specifically
about this.

Danny
>> On January 20th, I received this advisory; maybe it's helpful for
>> anyone: --- [...]
>> 
>> The "monlist" command of the NTP protocol is currently abused in
>> a DDoS reflection attack. This is done by spoofing packets from
>> addresses to which the attack is directed to. The ntp
>> installations itself are not target of the attack, but they are
>> part of the DDoS network which the attacker is driving. It is
>> therefore necessary to restrict ntp configurations to not answer
>> spoofed "monlist" requests. It is not necessary to update the
>> ntp software itself.
>> 
>> To ensure that your ntpd installation can not participate in a
>> DDoS attack, add the following line to your configuration:
>> 
>> restrict default noquery
>> 
[...]
>> Regards, Ulrich
>>> Attackers abused insecure Network Time Protocol servers to
>>> launch what appears to be one of the largest DDoS attacks ever
>>> reported.
>>> 
>>> See :

---

From: Brian Haberman <[email-masked]>
Date: Sat, 15 Feb 2014 11:45:46 -0500

Hi Danny,

> in RFC 1305 which has been obsoleted by RFC 5905.

Correct.  There is a draft in progress to document the mode 6 packets
(http://tools.ietf.org/html/draft-odonoghue-ntpv4-control-02).

> attack as all the other types return just the same size packets as the

It may be worthwhile to discuss the security implications of the mode 6
& 7 packets (in case another implementation decides to support them).

> So I think that my answer is in general yes, but not specifically

Makes sense and is the reason for my parenthetical "and maybe other" in
my initial question.

I would like to see some WG effort put into this type of document.

Regards,
Brian

---

From: [email-masked]
Date: Thu, 20 Feb 2014 17:28:44 +0100

I agree with Brian. I suppose a well written BCP should be very helpful for
a lot of administrators.

Regards
Dieter
----------------------------------
Physikalisch-Technische Bundesanstalt
Dr. Dieter Sibold
Q.42 - Serversysteme und Datenhaltung
QM-Verantwortlicher der Stelle IT-Infrastruktur
Bundesallee 100
D-38116 Braunschweig
Tel: +49-531-592-84 20
E-Mail: [email-masked]

Von:	Brian Haberman <[email-masked]>
An:	[email-masked]
Datum:	15.02.2014 19:35
Betreff:	Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS
            attack
Gesendet von:	ntpwg-bounces+dieter.sibold=[email-masked]

Hi Danny,

Regards,
Brian

[Anhang "signature.asc" gelöscht von Dieter Sibold/PTB]
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Steve Kostecke <[email-masked]>
Date: Thu, 20 Feb 2014 14:54:15 -0600

[email-masked] said:

>I agree with Brian. I suppose a well written BCP should be very helpful
>for a lot of administrators.

FWIW We've been blocking mode-7 packets at the NTP Public Services
Project firewall since 2009/11/08.

-- 
Steve Kostecke <[email-masked]>
NTP Public Services Project http://support.ntp.org/
Public Key at http://support.ntp.org/Users/SteveKostecke
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg