Create a DDOS attack using NTP servers

https://github.com/vpnguy/ntpdos

by uberspot • 12 years ago

40 28 12 years ago

github.com

Fuxy3• 12 years ago

That's a dangerous tool to be releasing this early but hey if you can why not :)

jgrahamc• 12 years ago

I disagree.

Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool.

They are trivial to perform and the solution, BCP38, needs to be rolled out.

http://blog.cloudflare.com/understanding-and-mitigating-ntp-...

Fuxy3• 12 years ago

I just don't want it to be too easy for the script kiddies. Anybody who understands the vulnerability could write this pretty easily.

vpnguy2• 12 years ago

If its so trivial why stress about me releasing it? I figured out how to write the attack from rfcs, wireshark and reports about attacks in early January. Also you can only launch an attack from somewhere that doesn't drop invalid udp packets (windows machines post XPSP2 and many consumer level ISPs) so it has skid protection naturally. To attack with this effectively someone could spawn a AWS instances id imagine.

Imagine my surprise as I was enjoying my cereal this morning and saw this on HN.

McGuffin• 12 years ago

This method of ddosing has been in quite widespread use for several months by now, though.

Artemis22• 12 years ago

I rather heard about DNS amplification attacks than NTP amplification recently.

mburgosh• 12 years ago

Spent the night last night dealing with this attack. Here is what you should know to deal with it:

https://www.us-cert.gov/ncas/alerts/TA14-013A

yoha• 12 years ago

Here are the important lines from ntpdos.py:

#Magic Packet aka NTP v2 Monlist Packet
data=str("\x17\x00\x03\x2a") + str("\x00")*4
packet = IP(dst=ntpserver,src=target)/UDP(sport=48947,dport=123)/Raw(load=data) #BUILD IT

ck2• 12 years ago

So can a server just close or move NTP ports to survive this and block default ports via firewall?

FiloSottile• 12 years ago

No, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sends big response to the target (the spoofed sender address).

This allows to send a much bigger DDoS from a less powerful uplink.

The target can't just firewall a port, as it does not rely on NTP being running on the target, but on some other unprotected machines.

eli• 12 years ago

On the plus side, I would imagine there are relatively limited number of NTP servers (at least compared to DNS when DDoS amplification attacks first caught on)

sp3322• 12 years ago

It's not a firewall problem. The target's server load will probably not even increase. But the pipe will be completely filled with bogus NTP responses. Legit traffic will barely trickle through whatever pipe you give it.

vpnguy2• 12 years ago

jnazario• 12 years ago

hdmoore re-disclosed this back on mar 2 2010. nothing new here. more about this:

https://labs.ripe.net/Members/mirjam/ntp-reflections

templates from the team cymru guys to secure your ntp installations, which have also been around a while.

http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-t...

sp3322• 12 years ago

The attack is ongoing https://news.ycombinator.com/item?id=7216492 It should be "nothing new" but too many people are still running vulnerable servers.

baldfat• 12 years ago

Hacking is always based off of exploiting other people's laziness. Well at least 95%.

xorrbit• 12 years ago

If you're concerned your NTP servers may have the monlist command enabled and therefore be available for attackers to use to mount these reflection attacks there is a Nessus plugin to check for this: http://www.tenable.com/plugins/index.php?view=single&id=7178...

Joona• 12 years ago

Is there an website where I could just paste the server IP?

hhw• 12 years ago

Try http://openntpproject.org/

legulere• 12 years ago

Has someone tried getting all vulnerable NTP servers with zmap and shutting them down?

jldugger• 12 years ago

Yes, I've been getting a steady trickle of email from this site: http://openntpproject.org/

jlgaddis• 12 years ago

  $ nmap -sU -pU:123 -Pn -n --script=ntp-monlist <target>

-- http://nmap.org/nsedoc/scripts/ntp-monlist.html

voilet• 12 years ago

59.151.34.14

Create a DDOS attack using NTP servers

Related Stories