4 ms·
As far as I can tell these attacks always rely on amplification using IP Spoofing. I take it there's no way of mitigating that in a lower layer without adding s
by aidos 13y ago
As far as I can tell these attacks always rely on amplification using IP Spoofing. I take it there's no way of mitigating that in a lower layer without adding some leaky abstraction or general overhead to the network? So, for example, (speaking as someone who knows nothing about these things) you could add some sort of handshake along the lines of:
ntp server sees request from 1.1.1.1 (spoofed by attacker)
ntp server goes to 1.1.1.1 to check that they really sent the request (sort of ack type thing)
1.1.1.1 comes back to say that it's an uninitiated request
ntp server discards similar future requests for some time
Obviously that would require more toing and froing, along with more white / black list tracking etc. Then again, can't all machines have sensible defaults in their firewalls to stop them from participating in such attacks?
Is this not an issue for TCP?
EDIT: I'm assuming it's because UDP doesn't do any checking / acknowledge stuff by default?
- devicenull 13y agoYes. And that's exactly what's been implemented in modern versions of ntpd (> 4.2.7p26, 2010/04/24... yes, 2010). The problem is: 1) No one has upgraded NTPD (and often can't, for embedded devices like IPMI controllers) 2) This can be fixed by basic configuration in older NTPD versions, but up until recently many linux distributions were shipping vulnerable configs. This particular command (monlist) is a management query, it's in no way related to serving up accurate time.
- michaelmior 13y agoAs far as I can tell, the default Ubuntu ntpd config still allows monlist. (That is, /etc/ntp.conf in saucy doesn't have disable monitor.)
- deleted 13y ago[deleted]
- dfc 13y agoWhat are the default restrictions? Is noquery enabled?
- devicenull 13y agodisable monitor is not really the best way to fix this. You're better off adding 'noquery' to the end of the 'restrict default' lines.
- michaelmior 13y agoThanks for clarifying. I'm not familiar with ntpd configuration as it's something I usually just install and forget about.
- makomk 13y agoThe Debian default config has noquery set for everywhere but localhost which is I believe safer (disables all ntpdc queries not just the one used here). Ubuntu's likely the same.
- michaelmior 13y agoThe default Ubuntu config has the following restrict -4 default kod notrap nomodify nopeer noquery restrict -6 default kod notrap nomodify nopeer noquery Edit: Note that this also exists in Ubuntu 12.04, so the latest LTS is fine as well.
- michaelmior 13y agoYes, noquery is enabled (at least in saucy). It isn't however in precise, which is the current LTS. I'm unclear of the difference between noquery and disable monitor.
- the_mitsuhiko 13y agoUDP is a message. It's the same as sending a letter with the sender's address on. You can lie about your own address, but if you want the other person to send you a reply it's better to write the correct information on.
- corresation 13y agoTCP establishes a two way connection (SYN, SYN-ACK, ACK), so you can send the original SYN but the SYN-ACK will go to someone else and be discarded. UDP is fire and forget, in contrast. There is a proposal from 2000 that is mentioned in the article (http://tools.ietf.org/html/rfc2827 http://tools.ietf.org/html/rfc2827) that recommends that source networks filter out originating traffic that isn't legitimate. It is being implemented slowly.