I've heard about new kind of DDOS where ntp is used for reflection .
My questions are really simple :
Can you please give details on how they work and clarify? Since ntp is ran over UDP, I suppose there must be some kind of forged packet somewhere?
How is it possible to exhaustively check if some ntp server are vulnerable (and can't be involved in any attack)?
If ever we become the target of such attack, is there any way to mitigate?
As this kind of attack has been widely used in 2014, here are a few more details :
- You can find more information ont this cve.
- "Yesterday evening 01/30/2014, starting at 22:15 CET, Witbe network in Paris has been seriously affected by a Distributed Denial of Service (DDOS) attack using NTP amplification."
- Ouch, 350Gpbs, that hurts http://www.itnews.com.au/News/372033,worlds-largest-ddos-strikes-us-europe.aspx
- Generic behaviour about ddos can be found here : I am under DDoS. What can I do?
- Bbc talks about ntp attacks : http://www.bbc.com/news/technology-26662051
- One more question : If I record correctly, openntpd listens by default on 127.0.0.1 and ntpd listens on 0.0.0.0 - I'm not really sure if all ntp servers involved in reflection ddos needed to serve time publically - Merely, I think some unskilled sysadmins installed ntp to synchronize time locally and left default configuration files.
A simple way to prevent and mitigate this kind of problem would be to listen on 127.0.0.1 by default? I guess this is true for any service (bind9, mysql, ...)?