Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is my NTP server costing $500 per year? Part 1 (2014)

blog.pivotal.io

Post reply on HN
Print view View original

11–20 of 113 posts

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#11

Post by libeclipse »

An interesting theory in one of the comments.

> I wonder if Puerto Rico has run out of its pool of IPv4 addresses. After Europe and Asia, just this month Latin America as well, have exhausted their IPv4 pools, many local ISPs have resorted to using NAT to deal with the scarcity of addresses (of course, after years procrastinating IPv6 and pretending that this day wouldn't come about). Given that the source is a Puerto Rican ISP, and one of the offending addresses from a small /21 network, it's possible that NAT is to blame. As ISP NAT increasingly becomes more prevalent, this is going to be rather touchy to deal with abuses. For is it an abuser or just several innocent users behind a NAT?

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#12

Post by Elrac »

zump wrote: post #10
preinheimer wrote: post #2

Reminds me of when Netgear decided to use the University of Wisconsin NTP servers as the default in their consumer products: http://pages.cs.wisc.edu/~plonka/netgear-sntp/

How is that even legal?

Once you put an NTP server on the 'net, it's public - pretty much like most Web sites. Sure, there are reasonable expectations of decency like for anything in the Commons, but I don't think there's any legal defense against skunks at the picnic.

IIRC, the university called Netgear out for doing something stupid and disruptive, and Netgear stopped doing it. The second best possible scenario, I guess.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#13

Post by quickben »

preinheimer wrote: post #2

Reminds me of when Netgear decided to use the University of Wisconsin NTP servers as the default in their consumer products: http://pages.cs.wisc.edu/~plonka/netgear-sntp/

The university commitment to still serve the public is admirable.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#14

Post by preinheimer »

Elrac wrote: post #12
zump wrote: post #10

Earlier quoted context omitted.

How is that even legal?

Once you put an NTP server on the 'net, it's public - pretty much like most Web sites. Sure, there are reasonable expectations of decency like for anything in the Commons, but I don't think there's any legal defense against skunks at the picnic. IIRC, the university called Netgear out for doing something stupid and disruptive, and Netgear stopped doing it. The second best possible scenario, I guess.

I believe an "agreement was forged", no public details, but I might assume some money changed hands.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#15

Post by DanBC »

Elrac wrote: post #12
zump wrote: post #10

Earlier quoted context omitted.

How is that even legal?

Once you put an NTP server on the 'net, it's public - pretty much like most Web sites. Sure, there are reasonable expectations of decency like for anything in the Commons, but I don't think there's any legal defense against skunks at the picnic. IIRC, the university called Netgear out for doing something stupid and disruptive, and Netgear stopped doing it. The second best possible scenario, I guess.

> Netgear stopped doing it.

Netgear issued patches for the devices. Most people never update their server firmware, and we're talking about over 700,000 devices. The university still gets considerable traffic.

https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#NE...

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#16

Post by BoorishBears »

preinheimer wrote: post #2

Reminds me of when Netgear decided to use the University of Wisconsin NTP servers as the default in their consumer products: http://pages.cs.wisc.edu/~plonka/netgear-sntp/

The most frustrating part of things like this, and that Snapchat issue, is the largest abusers could probably swallow the cost of their own NTP server usage as a rounding error to their bottom line.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#17

Post by tyingq »

libeclipse wrote: post #11

An interesting theory in one of the comments. > I wonder if Puerto Rico has run out of its pool of IPv4 addresses. After Europe and Asia, just this month Latin America as well, have exhausted their IPv4 pools, many local ISPs have resorted to using NAT to deal with the scarcity of addresses (of course, after years procrastinating IPv6 and pretending that this day wouldn't come about). Given that the source is a Puert…

I'm not understanding why NAT would cause it. I could see something like a misconfigured forwarding DNS cache causing it. Where it only queries pool.ntp.org once, and continues returning the result in the same order (with pivotal's ip at the top of the list) to a large number of querying clients. Then, perhaps, if there are a bunch of natted clients behind one ip? NAT, on it's own, without some other contributing factor, shouldn't cause this.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#18

Post by DanBC »

preinheimer wrote: post #14
Elrac wrote: post #12

Earlier quoted context omitted.

Once you put an NTP server on the 'net, it's public - pretty much like most Web sites. Sure, there are reasonable expectations of decency like for anything in the Commons, but I don't think there's any legal defense against skunks at the picnic. IIRC, the university called Netgear out for doing something stupid and disruptive, and Netgear stopped doing it. The second best possible scenario, I guess.

I believe an "agreement was forged", no public details, but I might assume some money changed hands.

$350,000.

https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse#NE...

> NETGEAR has donated $375,000 to the University of Wisconsin–Madison's Division of Information Technology for their help in identifying the flaw.

Although that appears to be uncited.

Re: Why is my NTP server costing $500 per year? Part 1 (2014)

#20

Post by moxious »

rupellohn wrote: post #19

Could this have been the result of an NTP amplification attack? https://www.us-cert.gov/ncas/alerts/TA13-088A

Article said no, because the traffic was symmetrical and not lopsided. If this had been part of an attack you'd expect to see far more outgoing bandwidth than incoming.
Post reply on HN