Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Create a DDOS attack using NTP servers

github.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Create a DDOS attack using NTP servers

#21

Post by Artemis2 »

vpnguy wrote: post #5
jgrahamc wrote: post #3

Earlier quoted context omitted.

I disagree. Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool. They are trivial to perform and the solution, BCP38, needs to be rolled out. http://blog.cloudflare.com/understanding-and-mitigating-ntp-...

If its so trivial why stress about me releasing it? I figured out how to write the attack from rfcs, wireshark and reports about attacks in early January. Also you can only launch an attack from somewhere that doesn't drop invalid udp packets (windows machines post XPSP2 and many consumer level ISPs) so it has skid protection naturally. To attack with this effectively someone could spawn a AWS instances id imagine. I…

AWS, along with other cloud providers such as Rackspace or Digital Ocean have specific detection techniques for DDoS from their servers, in order to maintain legal and reasonable use of their resources.

Also, that's not very responsible to release this script on HackForums, the home of every script kiddie around Internet.

Re: Create a DDOS attack using NTP servers

#22

Post by hhw »

Joona wrote: post #20
xorrbit wrote: post #17

If you're concerned your NTP servers may have the monlist command enabled and therefore be available for attackers to use to mount these reflection attacks there is a Nessus plugin to check for this: http://www.tenable.com/plugins/index.php?view=single&id=7178...

Is there an website where I could just paste the server IP?

Try http://openntpproject.org/

Re: Create a DDOS attack using NTP servers

#23

Post by Artemis2 »

McGuffin wrote: post #13
Fuxy wrote: post #2

That's a dangerous tool to be releasing this early but hey if you can why not :)

This method of ddosing has been in quite widespread use for several months by now, though.

I rather heard about DNS amplification attacks than NTP amplification recently.

Re: Create a DDOS attack using NTP servers

#24

Post by eli »

FiloSottile wrote: post #15
ck2 wrote: post #12

So can a server just close or move NTP ports to survive this and block default ports via firewall?

No, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sends big response to the target (the spoofed sender address). This allows to send a much bigger DDoS from a less powerful uplink. The target can't just firewall a port, as it does not rely on NTP being running on the target, but on some other unprotected machine…

On the plus side, I would imagine there are relatively limited number of NTP servers (at least compared to DNS when DDoS amplification attacks first caught on)

Re: Create a DDOS attack using NTP servers

#26

Post by baldfat »

sp332 wrote: post #18
jnazario wrote: post #16

hdmoore re-disclosed this back on mar 2 2010. nothing new here. more about this: https://labs.ripe.net/Members/mirjam/ntp-reflections templates from the team cymru guys to secure your ntp installations, which have also been around a while. http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-t...

The attack is ongoing https://news.ycombinator.com/item?id=7216492 It should be "nothing new" but too many people are still running vulnerable servers.

Hacking is always based off of exploiting other people's laziness. Well at least 95%.

Re: Create a DDOS attack using NTP servers

#28

Post by devicenull »

eli wrote: post #24
FiloSottile wrote: post #15

Earlier quoted context omitted.

No, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sends big response to the target (the spoofed sender address). This allows to send a much bigger DDoS from a less powerful uplink. The target can't just firewall a port, as it does not rely on NTP being running on the target, but on some other unprotected machine…

On the plus side, I would imagine there are relatively limited number of NTP servers (at least compared to DNS when DDoS amplification attacks first caught on)

You would wrong. Dedicated NTP servers yes, but there are things like routers, IPMI controllers, and firewalls that run the NTPD server. Even a bunch of linux distributions were shipping vulnerable daemons until a few weeks ago.

Anyone that's done ' install ntp' has the potential to be vulnerable, depending on configuration.

Post reply on HN