Create a DDOS attack using NTP servers
github.com
Create a DDOS attack using NTP servers
1–10 of 30 posts
Re: Create a DDOS attack using NTP servers
#2That's a dangerous tool to be releasing this early but hey if you can why not :)
Re: Create a DDOS attack using NTP servers
#3That's a dangerous tool to be releasing this early but hey if you can why not :)
I disagree.
Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool.
They are trivial to perform and the solution, BCP38, needs to be rolled out.
http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
Re: Create a DDOS attack using NTP servers
#4That's a dangerous tool to be releasing this early but hey if you can why not :)
I disagree. Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool. They are trivial to perform and the solution, BCP38, needs to be rolled out. http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
I just don't want it to be too easy for the script kiddies. Anybody who understands the vulnerability could write this pretty easily.
Re: Create a DDOS attack using NTP servers
#5That's a dangerous tool to be releasing this early but hey if you can why not :)
I disagree. Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool. They are trivial to perform and the solution, BCP38, needs to be rolled out. http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
If its so trivial why stress about me releasing it? I figured out how to write the attack from rfcs, wireshark and reports about attacks in early January. Also you can only launch an attack from somewhere that doesn't drop invalid udp packets (windows machines post XPSP2 and many consumer level ISPs) so it has skid protection naturally. To attack with this effectively someone could spawn a AWS instances id imagine.
Imagine my surprise as I was enjoying my cereal this morning and saw this on HN.
Re: Create a DDOS attack using NTP servers
#6Earlier quoted context omitted.
I disagree. Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool. They are trivial to perform and the solution, BCP38, needs to be rolled out. http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
If its so trivial why stress about me releasing it? I figured out how to write the attack from rfcs, wireshark and reports about attacks in early January. Also you can only launch an attack from somewhere that doesn't drop invalid udp packets (windows machines post XPSP2 and many consumer level ISPs) so it has skid protection naturally. To attack with this effectively someone could spawn a AWS instances id imagine. I…
Trivial for us doesn't mean trivial for everybody.
More specifically not really trivial for people who might use it irresponsibly because they don't understand the circumstances but hey it's just so easy.
I'm of the philosophy that there needs to be a barrier for entry sometimes.
Re: Create a DDOS attack using NTP servers
#7Spent the night last night dealing with this attack. Here is what you should know to deal with it:
Re: Create a DDOS attack using NTP servers
#8Earlier quoted context omitted.
I disagree. Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool. They are trivial to perform and the solution, BCP38, needs to be rolled out. http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
If its so trivial why stress about me releasing it? I figured out how to write the attack from rfcs, wireshark and reports about attacks in early January. Also you can only launch an attack from somewhere that doesn't drop invalid udp packets (windows machines post XPSP2 and many consumer level ISPs) so it has skid protection naturally. To attack with this effectively someone could spawn a AWS instances id imagine. I…
I'm unsure what you're hoping to accomplish by releasing this?
Also, you (or whoever 'DaRkReD' is, referenced in the script comments), released this on 01-22-2014 to hackforums.com. Personally, I find arming the script kiddies to be inexcusable behavior.
From the hackforums post:
> NTP has a feature called monlist which lists recent clients. Asking for the monlist takes about 90 bytes, the monlist is about 1640 bytes and since NTP is UDP we can spoof the IP origin and those 1640 bytes will go to your target of choice. As a result we have an 18x amplification attack so for every 1 byte you get sent you get 18 bytes sent to the target your home internet can now DOS 18x faster!
Re: Create a DDOS attack using NTP servers
#9[deleted]
Re: Create a DDOS attack using NTP servers
#10Earlier quoted context omitted.
I disagree. Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool. They are trivial to perform and the solution, BCP38, needs to be rolled out. http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
I just don't want it to be too easy for the script kiddies. Anybody who understands the vulnerability could write this pretty easily.
I didn't understand it before. I do now that I can see a working implementation. Words are wind, functional code is powerful :)
At least there isn't a supplied list of ntp servers.