Here are the important lines from ntpdos.py:
> #Magic Packet aka NTP v2 Monlist Packet
> data=str("\x17\x00\x03\x2a") + str("\x00")*4
> packet = IP(dst=ntpserver,src=target)/UDP(sport=48947,dport=123)/Raw(load=data) #BUILD IT
Create a DDOS attack using NTP servers
11–20 of 30 posts
Re: Create a DDOS attack using NTP servers
#12So can a server just close or move NTP ports to survive this and block default ports via firewall?
Re: Create a DDOS attack using NTP servers
#13That's a dangerous tool to be releasing this early but hey if you can why not :)
This method of ddosing has been in quite widespread use for several months by now, though.
Re: Create a DDOS attack using NTP servers
#14Suggested reading:
http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
Re: Create a DDOS attack using NTP servers
#15So can a server just close or move NTP ports to survive this and block default ports via firewall?
No, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sends big response to the target (the spoofed sender address).
This allows to send a much bigger DDoS from a less powerful uplink.
The target can't just firewall a port, as it does not rely on NTP being running on the target, but on some other unprotected machines.
Re: Create a DDOS attack using NTP servers
#16hdmoore re-disclosed this back on mar 2 2010. nothing new here. more about this:
https://labs.ripe.net/Members/mirjam/ntp-reflections
templates from the team cymru guys to secure your ntp installations, which have also been around a while.
http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-t...
Re: Create a DDOS attack using NTP servers
#17If you're concerned your NTP servers may have the monlist command enabled and therefore be available for attackers to use to mount these reflection attacks there is a Nessus plugin to check for this: http://www.tenable.com/plugins/index.php?view=single&id=7178...
Re: Create a DDOS attack using NTP servers
#18hdmoore re-disclosed this back on mar 2 2010. nothing new here. more about this: https://labs.ripe.net/Members/mirjam/ntp-reflections templates from the team cymru guys to secure your ntp installations, which have also been around a while. http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-t...
The attack is ongoing https://news.ycombinator.com/item?id=7216492 It should be "nothing new" but too many people are still running vulnerable servers.
Re: Create a DDOS attack using NTP servers
#19So can a server just close or move NTP ports to survive this and block default ports via firewall?
It's not a firewall problem. The target's server load will probably not even increase. But the pipe will be completely filled with bogus NTP responses. Legit traffic will barely trickle through whatever pipe you give it.
Re: Create a DDOS attack using NTP servers
#20If you're concerned your NTP servers may have the monlist command enabled and therefore be available for attackers to use to mount these reflection attacks there is a Nessus plugin to check for this: http://www.tenable.com/plugins/index.php?view=single&id=7178...
Is there an website where I could just paste the server IP?