6 ms·
Create a DDOS attack using NTP servers
- Fuxy 13y agoThat's a dangerous tool to be releasing this early but hey if you can why not :)
- jgrahamc 13y agoI disagree. Although some people might take this tool and a list of NTP servers and use it to generate a DDoS against a site or service, it's worth seeing just how simple these attacks are by examining this tool. They are trivial to perform and the solution, BCP38, needs to be rolled out. http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
- Fuxy 13y agoI just don't want it to be too easy for the script kiddies. Anybody who understands the vulnerability could write this pretty easily.
- aaren 13y agoI didn't understand it before. I do now that I can see a working implementation. Words are wind, functional code is powerful :) At least there isn't a supplied list of ntp servers.
- vpnguy 13y agoIf its so trivial why stress about me releasing it? I figured out how to write the attack from rfcs, wireshark and reports about attacks in early January. Also you can only launch an attack from somewhere that doesn't drop invalid udp packets (windows machines post XPSP2 and many consumer level ISPs) so it has skid protection naturally. To attack with this effectively someone could spawn a AWS instances id imagine. Imagine my surprise as I was enjoying my cereal this morning and saw this on HN.
- devicenull 13y agoI'm unsure what you're hoping to accomplish by releasing this? Also, you (or whoever 'DaRkReD' is, referenced in the script comments), released this on 01-22-2014 to hackforums.com. Personally, I find arming the script kiddies to be inexcusable behavior. From the hackforums post: > NTP has a feature called monlist which lists recent clients. Asking for the monlist takes about 90 bytes, the monlist is about 1640 bytes and since NTP is UDP we can spoof the IP origin and those 1640 bytes will go to your target of choice. As a result we have an 18x amplification attack so for every 1 byte you get sent you get 18 bytes sent to the target your home internet can now DOS 18x faster!
- Fuxy 13y agoTrivial for us doesn't mean trivial for everybody. More specifically not really trivial for people who might use it irresponsibly because they don't understand the circumstances but hey it's just so easy. I'm of the philosophy that there needs to be a barrier for entry sometimes.
- Artemis2 13y agoAWS, along with other cloud providers such as Rackspace or Digital Ocean have specific detection techniques for DDoS from their servers, in order to maintain legal and reasonable use of their resources. Also, that's not very responsible to release this script on HackForums, the home of every script kiddie around Internet.
- McGuffin 13y agoThis method of ddosing has been in quite widespread use for several months by now, though.
- Artemis2 13y agoI rather heard about DNS amplification attacks than NTP amplification recently.
- mburgosh 13y agoSpent the night last night dealing with this attack. Here is what you should know to deal with it: https://www.us-cert.gov/ncas/alerts/TA14-013A https://www.us-cert.gov/ncas/alerts/TA14-013A
- deleted 13y ago[deleted]
- yoha 13y agoHere are the important lines from ntpdos.py: > #Magic Packet aka NTP v2 Monlist Packet > data=str("\x17\x00\x03\x2a") + str("\x00")*4 > packet = IP(dst=ntpserver,src=target)/UDP(sport=48947,dport=123)/Raw(load=data) #BUILD IT
- ck2 13y agoSo can a server just close or move NTP ports to survive this and block default ports via firewall?
- FiloSottile 13y agoNo, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sends big response to the target (the spoofed sender address). This allows to send a much bigger DDoS from a less powerful uplink. The target can't just firewall a port, as it does not rely on NTP being running on the target, but on some other unprotected machines.
- eli 13y agoOn the plus side, I would imagine there are relatively limited number of NTP servers (at least compared to DNS when DDoS amplification attacks first caught on)
- devicenull 13y agoYou would wrong. Dedicated NTP servers yes, but there are things like routers, IPMI controllers, and firewalls that run the NTPD server. Even a bunch of linux distributions were shipping vulnerable daemons until a few weeks ago. Anyone that's done '<package manager> install ntp' has the potential to be vulnerable, depending on configuration.
- sp332 13y agoIt's not a firewall problem. The target's server load will probably not even increase. But the pipe will be completely filled with bogus NTP responses. Legit traffic will barely trickle through whatever pipe you give it.
- vpnguy 13y agoSuggested reading: http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
- jnazario 13y agohdmoore re-disclosed this back on mar 2 2010. nothing new here. more about this: https://labs.ripe.net/Members/mirjam/ntp-reflections https://labs.ripe.net/Members/mirjam/ntp-reflections templates from the team cymru guys to secure your ntp installations, which have also been around a while. http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-t...
- sp332 13y agoThe attack is ongoing https://news.ycombinator.com/item?id=7216492 https://news.ycombinator.com/item?id=7216492 It should be "nothing new" but too many people are still running vulnerable servers.
- baldfat 13y agoHacking is always based off of exploiting other people's laziness. Well at least 95%.
- xorrbit 13y agoIf you're concerned your NTP servers may have the monlist command enabled and therefore be available for attackers to use to mount these reflection attacks there is a Nessus plugin to check for this: http://www.tenable.com/plugins/index.php?view=single&id=71783 http://www.tenable.com/plugins/index.php?view=single&id=7178...
- legulere 13y agoHas someone tried getting all vulnerable NTP servers with zmap and shutting them down?
- jldugger 13y agoYes, I've been getting a steady trickle of email from this site: http://openntpproject.org/ http://openntpproject.org/
- jlgaddis 13y ago$ nmap -sU -pU:123 -Pn -n --script=ntp-monlist <target> -- http://nmap.org/nsedoc/scripts/ntp-monlist.html http://nmap.org/nsedoc/scripts/ntp-monlist.html
- voilet 13y ago59.151.34.14