4 ms·
No, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sen
by FiloSottile 13y ago
No, what this is exposing is a threat like the DNS DDoS amplification. He sends NTP servers small packets, spoofing the sender address (UDP), and the server sends big response to the target (the spoofed sender address).
This allows to send a much bigger DDoS from a less powerful uplink.
The target can't just firewall a port, as it does not rely on NTP being running on the target, but on some other unprotected machines.
- eli 13y agoOn the plus side, I would imagine there are relatively limited number of NTP servers (at least compared to DNS when DDoS amplification attacks first caught on)
- devicenull 13y agoYou would wrong. Dedicated NTP servers yes, but there are things like routers, IPMI controllers, and firewalls that run the NTPD server. Even a bunch of linux distributions were shipping vulnerable daemons until a few weeks ago. Anyone that's done '<package manager> install ntp' has the potential to be vulnerable, depending on configuration.