From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Wed Feb 12 23:43:44 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF5AA1A0144 for ; Wed, 12 Feb 2014 23:43:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.746 X-Spam-Level: X-Spam-Status: No, score=-4.746 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nM2_dS-M9rU7 for ; Wed, 12 Feb 2014 23:43:42 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by ietfa.amsl.com (Postfix) with ESMTP id 8AF471A0147 for ; Wed, 12 Feb 2014 23:43:42 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id BD45C86D73C for ; Thu, 13 Feb 2014 07:43:41 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 35D3986D521 for ; Thu, 13 Feb 2014 07:42:18 +0000 (UTC) Received: from mailrelay01-ib2.rad.com ([91.143.228.146] helo=rad.co.il) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WDqvy-000DYW-CO for ntpwg@lists.ntp.org; Thu, 13 Feb 2014 07:42:18 +0000 Received: from Internal Mail-Server by MailRelay01 (envelope-from yaakov?s@rad.com) with RC4-SHA encrypted SMTP; 13 Feb 2014 09:41:19 +0200 Received: from EXRAD6.ad.rad.co.il (2002:c072:18be::c072:18be) by exrad6.ad.rad.co.il (2002:c072:18be::c072:18be) with Microsoft SMTP Server (TLS) id 15.0.775.38; Thu, 13 Feb 2014 09:41:59 +0200 Received: from EXRAD6.ad.rad.co.il ([fe80::f157:6202:5fc8:a4f0]) by exrad6.ad.rad.co.il ([fe80::f157:6202:5fc8:a4f0%12]) with mapi id 15.00.0775.031; Thu, 13 Feb 2014 09:41:59 +0200 From: Yaakov Stein To: "ntpwg@lists.ntp.org" Thread-Topic: Attackers use NTP reflection in huge DDoS attack Thread-Index: Ac8ojxNGY0WxuJoMTiCAm/4Hg1+BDA== Date: Thu, 13 Feb 2014 07:41:59 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2002:c073:f33e::c073:f33e] MIME-Version: 1.0 X-Commtouch-Refid: str=0001.0A0C0203.52FC7748.00D2, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0 (Unknown) X-SA-Exim-Connect-IP: 91.143.228.146 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: yaakov_s@rad.com X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: "tictoc@ietf.org" Subject: [ntpwg] Attackers use NTP reflection in huge DDoS attack X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============3383386002040194375==" Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org --===============3383386002040194375== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_f269255720f044ebb52f6db0b9309a31exrad6adradcoil_" --_000_f269255720f044ebb52f6db0b9309a31exrad6adradcoil_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Attackers abused insecure Network Time Protocol servers to launch what appe= ars to be one of the largest DDoS attacks ever reported. See : http://www.computerworld.com/s/article/9246230/Attackers_use_NTP_reflection= _in_huge_DDoS_attack http://www.informationweek.com/security/attacks-and-breaches/ddos-attack-hi= ts-400-gbit-s-breaks-record/d/d-id/1113787 http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-atta= cks Y(J)S --_000_f269255720f044ebb52f6db0b9309a31exrad6adradcoil_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Attackers abused insecure N= etwork Time Protocol servers to launch what appears to be one of the larges= t DDoS attacks ever reported.

 =

See :

http://www.computer= world.com/s/article/9246230/Attackers_use_NTP_reflection_in_huge_DDoS_attac= k

http://www.informationweek.com/security/attacks-and-breaches/ddos-attack= -hits-400-gbit-s-breaks-record/d/d-id/1113787

http://blog.cloudflare.com/understan= ding-and-mitigating-ntp-based-ddos-attacks

 

 

Y(J)S

 

--_000_f269255720f044ebb52f6db0b9309a31exrad6adradcoil_-- --===============3383386002040194375== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg --===============3383386002040194375==-- From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Fri Feb 14 01:02:36 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91DC01A0115 for ; Fri, 14 Feb 2014 01:02:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ce4h8ZzHB5_K for ; Fri, 14 Feb 2014 01:02:34 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by ietfa.amsl.com (Postfix) with ESMTP id 1AA171A0123 for ; Fri, 14 Feb 2014 01:02:34 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id CDF6986D85F for ; Fri, 14 Feb 2014 09:02:32 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id E458D86D4E3 for ; Fri, 14 Feb 2014 08:08:15 +0000 (UTC) Received: from rrzmta1.uni-regensburg.de ([194.94.155.51]) by mail1.ntp.org with esmtps (TLSv1:CAMELLIA256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WEDod-000PD0-UR for ntpwg@lists.ntp.org; Fri, 14 Feb 2014 08:08:15 +0000 Received: from rrzmta1.uni-regensburg.de (localhost [127.0.0.1]) by localhost (Postfix) with SMTP id 84F8736B24 for ; Fri, 14 Feb 2014 09:07:59 +0100 (CET) Received: from gwsmtp1.uni-regensburg.de (gwsmtp1.uni-regensburg.de [132.199.5.51]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "gwsmtp.uni-regensburg.de", Issuer "Uni Regensburg CA - G01" (not verified)) by rrzmta1.uni-regensburg.de (Postfix) with ESMTPS id 4DF1B36A33 for ; Fri, 14 Feb 2014 09:07:59 +0100 (CET) Received: from uni-regensburg-smtp1-MTA by gwsmtp1.uni-regensburg.de with Novell_GroupWise; Fri, 14 Feb 2014 09:05:45 +0100 Message-Id: <52FDDCED020000A1000145E5@gwsmtp1.uni-regensburg.de> X-Mailer: Novell GroupWise Internet Agent 12.0.2 Date: Fri, 14 Feb 2014 09:07:57 +0100 From: "Ulrich Windl" To: "ntpwg@lists.ntp.org" , "Yaakov Stein" References: In-Reply-To: Mime-Version: 1.0 Content-Disposition: inline X-SA-Exim-Connect-IP: 194.94.155.51 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: Ulrich.Windl@rz.uni-regensburg.de X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: "tictoc@ietf.org" Subject: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org On January 20th, I received this advisory; maybe it's helpful for anyone: --- [...] 1) problem description, brief discussion The "monlist" command of the NTP protocol is currently abused in a DDoS reflection attack. This is done by spoofing packets from addresses to which the attack is directed to. The ntp installations itself are not target of the attack, but they are part of the DDoS network which the attacker is driving. It is therefore necessary to restrict ntp configurations to not answer spoofed "monlist" requests. It is not necessary to update the ntp software itself. Additional information can be found here: https://www.cert-bund.de/advisoryshort/CB-K14-0020%20UPDATE%202 http://www.kb.cert.org/vuls/id/348126 A more comprehensive description on how you can secure your infrastructure against NTP DDoS reflection attacks can be found here: http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html 2) solution/workaround To ensure that your ntpd installation can not participate in a DDoS attack, add the following line to your configuration: restrict default noquery 3) special instructions and notes After applying the configuration changes, restart the ntp daemon. 4) package location and checksums not applicable ______________________________________________________________________________ [...] Regards, Ulrich >>> Yaakov Stein schrieb am 13.02.2014 um 08:41 in Nachricht : > Attackers abused insecure Network Time Protocol servers to launch what > appears to be one of the largest DDoS attacks ever reported. > > See : > http://www.computerworld.com/s/article/9246230/Attackers_use_NTP_reflection_ > in_huge_DDoS_attack > http://www.informationweek.com/security/attacks-and-breaches/ddos-attack-hits-400- > gbit-s-breaks-record/d/d-id/1113787 > http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks > > > Y(J)S _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Fri Feb 14 07:58:09 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7EBD1A0270 for ; Fri, 14 Feb 2014 07:58:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PVvgm_xmnGWf for ; Fri, 14 Feb 2014 07:58:08 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by ietfa.amsl.com (Postfix) with ESMTP id 379AF1A0242 for ; Fri, 14 Feb 2014 07:58:08 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id D5DCC86D831 for ; Fri, 14 Feb 2014 15:58:06 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 362A986D4E3 for ; Fri, 14 Feb 2014 14:54:13 +0000 (UTC) Received: from mail.ietf.org ([4.31.198.44]) by mail1.ntp.org with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WEK9V-0005dk-DY for ntpwg@lists.ntp.org; Fri, 14 Feb 2014 14:54:13 +0000 Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 137511A02AE for ; Fri, 14 Feb 2014 06:54:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GsLxQEpg8cMj; Fri, 14 Feb 2014 06:53:59 -0800 (PST) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B1591A028A; Fri, 14 Feb 2014 06:53:59 -0800 (PST) MIME-Version: 1.0 From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.0.0.p1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140214145359.13043.22069.idtracker@ietfa.amsl.com> Date: Fri, 14 Feb 2014 06:53:59 -0800 X-SA-Exim-Connect-IP: 4.31.198.44 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: internet-drafts@ietf.org X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: ntpwg@lists.ntp.org Subject: [ntpwg] I-D Action: draft-ietf-ntp-network-time-security-02.txt X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network Time Protocol Working Group of the IETF. Title : Network Time Security Authors : Dieter Sibold Stephen Roettger Kristof Teichel Filename : draft-ietf-ntp-network-time-security-02.txt Pages : 23 Date : 2014-02-14 Abstract: This document describes the Network Time Security (NTS) protocol that enables secure authentication of time servers using Network Time Protocol (NTP) or Precision Time Protocol (PTP). Its design considers the special requirements of precise timekeeping, which are described in Security Requirements of Time Protocols in Packet Switched Networks [I-D.ietf-tictoc-security-requirements]. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ntp-network-time-security/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-ntp-network-time-security-02 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-ntp-network-time-security-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Fri Feb 14 09:33:23 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 413251A034F for ; Fri, 14 Feb 2014 09:33:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5g_6xt-eF9SE for ; Fri, 14 Feb 2014 09:33:16 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by ietfa.amsl.com (Postfix) with ESMTP id F05601A034C for ; Fri, 14 Feb 2014 09:33:15 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 9541486D83B for ; Fri, 14 Feb 2014 17:33:14 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 33DFF86D4E3 for ; Fri, 14 Feb 2014 16:10:13 +0000 (UTC) Received: from uillean.fuaim.com ([206.197.161.140]) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WELL3-00061Q-A2 for ntpwg@lists.ntp.org; Fri, 14 Feb 2014 16:10:12 +0000 Received: from clairseach.fuaim.com (clairseach-high.fuaim.com [206.197.161.158]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by uillean.fuaim.com (Postfix) with ESMTP id C5CB8880A7 for ; Fri, 14 Feb 2014 08:10:04 -0800 (PST) Received: from 102525176.rudm1.ra.johnshopkins.edu (addr16212925014.ippl.jhmi.edu [162.129.250.14]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by clairseach.fuaim.com (Postfix) with ESMTP id 07042136814C for ; Fri, 14 Feb 2014 08:10:03 -0800 (PST) Message-ID: <52FE3FDD.9040105@innovationslab.net> Date: Fri, 14 Feb 2014 11:10:05 -0500 From: Brian Haberman User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: ntpwg@lists.ntp.org References: <52FDDCED020000A1000145E5@gwsmtp1.uni-regensburg.de> In-Reply-To: <52FDDCED020000A1000145E5@gwsmtp1.uni-regensburg.de> X-Enigmail-Version: 1.6 X-SA-Exim-Connect-IP: 206.197.161.140 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: brian@innovationslab.net X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Subject: Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============0573435253251865051==" Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============0573435253251865051== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="oF9lPfOFGVreit6XsgJPVib598JsNJ9uk" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --oF9lPfOFGVreit6XsgJPVib598JsNJ9uk Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable A question for the group... Do we need to codify these (and maybe other) security guidelines in a BCP= ? Brian On 2/14/14 3:07 AM, Ulrich Windl wrote: > On January 20th, I received this advisory; maybe it's helpful for anyon= e: > --- > [...] >=20 > 1) problem description, brief discussion >=20 > The "monlist" command of the NTP protocol is currently abused in a D= DoS > reflection attack. This is done by spoofing packets from addresses t= o which > the attack is directed to. The ntp installations itself are not targ= et of > the attack, but they are part of the DDoS network which the attacker= is > driving. It is therefore necessary to restrict ntp configurations to= not > answer spoofed "monlist" requests. It is not necessary to update the= ntp > software itself. >=20 > Additional information can be found here: >=20 > https://www.cert-bund.de/advisoryshort/CB-K14-0020%20UPDATE%202=20 > http://www.kb.cert.org/vuls/id/348126=20 >=20 > A more comprehensive description on how you can secure your > infrastructure against NTP DDoS reflection attacks can be found here= : >=20 > http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.= html=20 >=20 > 2) solution/workaround >=20 > To ensure that your ntpd installation can not participate in a DDoS = attack, > add the following line to your configuration: >=20 > restrict default noquery >=20 > 3) special instructions and notes >=20 > After applying the configuration changes, restart the ntp daemon. >=20 > 4) package location and checksums >=20 > not applicable >=20 > _______________________________________________________________________= _______ > [...] >=20 > Regards, > Ulrich >=20 >>>> Yaakov Stein schrieb am 13.02.2014 um 08:41 in Na= chricht > : >> Attackers abused insecure Network Time Protocol servers to launch what= =20 >> appears to be one of the largest DDoS attacks ever reported. >> >> See : >> http://www.computerworld.com/s/article/9246230/Attackers_use_NTP_refle= ction_=20 >> in_huge_DDoS_attack >> http://www.informationweek.com/security/attacks-and-breaches/ddos-atta= ck-hits-400-=20 >> gbit-s-breaks-record/d/d-id/1113787 >> http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos= -attacks=20 >> >> >> Y(J)S >=20 >=20 >=20 > _______________________________________________ > ntpwg mailing list > ntpwg@lists.ntp.org > http://lists.ntp.org/listinfo/ntpwg >=20 --oF9lPfOFGVreit6XsgJPVib598JsNJ9uk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.20 (Darwin) Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJS/j/dAAoJEBOZRqCi7goqjwYIANFe/dXqaISxBuMtV/D9NfzY ibPJMHy+ZqVDr1D3v4PPPLl9aSEWdOmZKrRbEA0z06zl9eYslFD2ShkJyJytkkYV J2AUMX1F6wxjcxa4XykVNgsYUP/rj1Os+m8VQ99oIZC6uh2F8q2s5f/w5xUc+jF4 5s3dXOJxRooxU5dhj4co2x9RDeCoKJgrKndf4bFsVrc9e6euCBsaz1HEtosM/GDt 7FC22dRtc7HCTLXFCGr+v9bxPAEUPJsuQhYsrkEf0oMWQecVa6P2WD4c6mb/CVyW NIxpNn1P2H11cV+oGYmu6OobbpYPMWWOrlzlLAQgVRBv4OYHw12pKyKsjZ4H0Ho= =UlRl -----END PGP SIGNATURE----- --oF9lPfOFGVreit6XsgJPVib598JsNJ9uk-- --===============0573435253251865051== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg --===============0573435253251865051==-- From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Fri Feb 14 19:24:18 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53C6C1A0018 for ; Fri, 14 Feb 2014 19:24:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5XJCevslZDPX for ; Fri, 14 Feb 2014 19:24:15 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id B60081A000E for ; Fri, 14 Feb 2014 19:24:15 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 5955586D783 for ; Sat, 15 Feb 2014 03:24:14 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id B9D2686D4E3 for ; Sat, 15 Feb 2014 02:10:32 +0000 (UTC) Received: from static-108-1-140-244.bstnma.east.verizon.net ([108.1.140.244] helo=[10.10.10.102]) by mail1.ntp.org with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WEUi5-0008Wx-Qm; Sat, 15 Feb 2014 02:10:32 +0000 Message-ID: <52FECC6F.5070903@ntp.org> Date: Fri, 14 Feb 2014 21:09:51 -0500 From: Danny Mayer Organization: NTP User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Brian Haberman , ntpwg@lists.ntp.org References: <52FDDCED020000A1000145E5@gwsmtp1.uni-regensburg.de> <52FE3FDD.9040105@innovationslab.net> In-Reply-To: <52FE3FDD.9040105@innovationslab.net> X-Enigmail-Version: 1.6 X-SA-Exim-Connect-IP: 108.1.140.244 X-SA-Exim-Rcpt-To: brian@innovationslab.net, ntpwg@lists.ntp.org X-SA-Exim-Mail-From: mayer@ntp.org X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Subject: Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: mayer@ntp.org List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org On 2/14/2014 11:10 AM, Brian Haberman wrote: > A question for the group... > > Do we need to codify these (and maybe other) security guidelines in > a BCP? > > Brian For this particular attack, I'm not so sure since they involve mode 7 packets and as far as I know only the reference implementation from ntp.org implements them as well as mode 6 packets which are also meant as management tools. These packets are not well documented, particularly mode 7 and I believe only mode 6 packets are documented in RFC 1305 which has been obsoleted by RFC 5905. Only mode 6 and mode 7 packets could be used in an amplification attack as all the other types return just the same size packets as the incoming ones. There is a general need for a BCP for NTP, partiucularly over things like Rules of Engagement and KOD packets. Some the more well-known NTP servers (like NIST and USNO) are overwhelmed with packets, hardware manufacturers have hard-coded IP addresses of NTP servers, and some software just bombards NTP servers with requests. So I think that my answer is in general yes, but not specifically about this. Danny > > > On 2/14/14 3:07 AM, Ulrich Windl wrote: >> On January 20th, I received this advisory; maybe it's helpful for >> anyone: --- [...] >> >> 1) problem description, brief discussion >> >> The "monlist" command of the NTP protocol is currently abused in >> a DDoS reflection attack. This is done by spoofing packets from >> addresses to which the attack is directed to. The ntp >> installations itself are not target of the attack, but they are >> part of the DDoS network which the attacker is driving. It is >> therefore necessary to restrict ntp configurations to not answer >> spoofed "monlist" requests. It is not necessary to update the >> ntp software itself. >> >> Additional information can be found here: >> >> https://www.cert-bund.de/advisoryshort/CB-K14-0020%20UPDATE%202 >> http://www.kb.cert.org/vuls/id/348126 >> >> A more comprehensive description on how you can secure your >> infrastructure against NTP DDoS reflection attacks can be found >> here: >> >> http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html >> >> >> 2) solution/workaround >> >> To ensure that your ntpd installation can not participate in a >> DDoS attack, add the following line to your configuration: >> >> restrict default noquery >> >> 3) special instructions and notes >> >> After applying the configuration changes, restart the ntp >> daemon. >> >> 4) package location and checksums >> >> not applicable >> >> ______________________________________________________________________________ >> >> [...] >> >> Regards, Ulrich >> >>>>> Yaakov Stein schrieb am 13.02.2014 um >>>>> 08:41 in Nachricht >> : >>> Attackers abused insecure Network Time Protocol servers to >>> launch what appears to be one of the largest DDoS attacks ever >>> reported. >>> >>> See : >>> http://www.computerworld.com/s/article/9246230/Attackers_use_NTP_reflection_ >>> in_huge_DDoS_attack >>> http://www.informationweek.com/security/attacks-and-breaches/ddos-attack-hits-400- >>> gbit-s-breaks-record/d/d-id/1113787 >>> http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks >>> >>> >>> >>> Y(J)S >> >> _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sat Feb 15 10:37:08 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC3511A0274 for ; Sat, 15 Feb 2014 10:37:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.748 X-Spam-Level: X-Spam-Status: No, score=-4.748 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PbBTu1mu-MX8 for ; Sat, 15 Feb 2014 10:37:07 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by ietfa.amsl.com (Postfix) with ESMTP id 02EDA1A026E for ; Sat, 15 Feb 2014 10:37:06 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 4FEB386D60E for ; Sat, 15 Feb 2014 18:37:05 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id D1FA286D33D for ; Sat, 15 Feb 2014 16:46:04 +0000 (UTC) Received: from uillean.fuaim.com ([206.197.161.140]) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WEiNH-000HDD-P6 for ntpwg@lists.ntp.org; Sat, 15 Feb 2014 16:46:04 +0000 Received: from clairseach.fuaim.com (clairseach-high.fuaim.com [206.197.161.158]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by uillean.fuaim.com (Postfix) with ESMTP id 2463F880D1 for ; Sat, 15 Feb 2014 08:45:55 -0800 (PST) Received: from Littlejohn.local (c-76-21-129-88.hsd1.md.comcast.net [76.21.129.88]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by clairseach.fuaim.com (Postfix) with ESMTP id 93C3C130002 for ; Sat, 15 Feb 2014 08:45:54 -0800 (PST) Message-ID: <52FF99BA.6040709@innovationslab.net> Date: Sat, 15 Feb 2014 11:45:46 -0500 From: Brian Haberman User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: ntpwg@lists.ntp.org References: <52FDDCED020000A1000145E5@gwsmtp1.uni-regensburg.de> <52FE3FDD.9040105@innovationslab.net> <52FECC6F.5070903@ntp.org> In-Reply-To: <52FECC6F.5070903@ntp.org> X-Enigmail-Version: 1.6 X-SA-Exim-Connect-IP: 206.197.161.140 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: brian@innovationslab.net X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Subject: Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============6413180314542115787==" Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============6413180314542115787== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Wxp0GaGTrIqmaqELdlntd61o9WEGniEBc" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Wxp0GaGTrIqmaqELdlntd61o9WEGniEBc Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Hi Danny, On 2/14/14 9:09 PM, Danny Mayer wrote: > On 2/14/2014 11:10 AM, Brian Haberman wrote: >> A question for the group... >> >> Do we need to codify these (and maybe other) security guidelines in >> a BCP? >> >> Brian >=20 > For this particular attack, I'm not so sure since they involve mode 7 > packets and as far as I know only the reference implementation from > ntp.org implements them as well as mode 6 packets which are also meant > as management tools. These packets are not well documented, > particularly mode 7 and I believe only mode 6 packets are documented > in RFC 1305 which has been obsoleted by RFC 5905. Correct. There is a draft in progress to document the mode 6 packets (http://tools.ietf.org/html/draft-odonoghue-ntpv4-control-02). >=20 > Only mode 6 and mode 7 packets could be used in an amplification > attack as all the other types return just the same size packets as the > incoming ones. It may be worthwhile to discuss the security implications of the mode 6 & 7 packets (in case another implementation decides to support them). >=20 > There is a general need for a BCP for NTP, partiucularly over things > like Rules of Engagement and KOD packets. Some the more well-known NTP > servers (like NIST and USNO) are overwhelmed with packets, hardware > manufacturers have hard-coded IP addresses of NTP servers, and some > software just bombards NTP servers with requests. >=20 > So I think that my answer is in general yes, but not specifically > about this. Makes sense and is the reason for my parenthetical "and maybe other" in my initial question. I would like to see some WG effort put into this type of document. Regards, Brian --Wxp0GaGTrIqmaqELdlntd61o9WEGniEBc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.20 (Darwin) Comment: GPGTools - https://gpgtools.org iQEcBAEBCgAGBQJS/5nBAAoJEBOZRqCi7goqxnAIAMVJqB/tHyd7YFCWB220vMb2 42vKOZ9ER4hOOGPpWpb1Hljoo0F0tcX3gMwfWQ2tI0PPmZCANuv4Pp9p2db5YfnE bSSVsvu5sKcrJfQhuvTARtLVS/U9Uq9V/+AfCu9j9wKlQS9shlDbFyy5B8Ad8PPu RMUmbCZZOPKGBQny0D5n3OC0USOU1G3M39RY2dDTC5oEFmGYrGzmAVYQyfdX4pqh ps9nVoWn8zlEHKnmJUuSYia4qfK0DZiucJnux85S/l/Xqq2A0LnsqR3xCvaVjgAN Lk3Acke7i+hhqqAfQdPWxhLUdw3wGzzOoi1TqQipO+A/Buq3uoi17YIIM7kCW/8= =svPy -----END PGP SIGNATURE----- --Wxp0GaGTrIqmaqELdlntd61o9WEGniEBc-- --===============6413180314542115787== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg --===============6413180314542115787==-- From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Thu Feb 20 12:29:51 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEFF31A0293 for ; Thu, 20 Feb 2014 12:29:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0sjzpRs9p92j for ; Thu, 20 Feb 2014 12:29:49 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id 948F31A0299 for ; Thu, 20 Feb 2014 12:29:47 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 0749686D33D for ; Thu, 20 Feb 2014 20:29:43 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 0E0C786D33D; Thu, 20 Feb 2014 16:29:02 +0000 (UTC) Received: from mx1.bs.ptb.de ([192.53.103.106]) by mail1.ntp.org with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WGWUY-000Ol5-6A; Thu, 20 Feb 2014 16:29:02 +0000 Received: from mx1.bs.ptb.de (localhost [127.0.0.1]) by localhost (Postfix) with SMTP id 02ED6D139D1; Thu, 20 Feb 2014 17:28:47 +0100 (CET) Received: from rose.bs.ptb.de (rose.bs.ptb.de [141.25.85.201]) by mx1.bs.ptb.de (Postfix) with ESMTP id D60C2D1378A; Thu, 20 Feb 2014 17:28:46 +0100 (CET) In-Reply-To: <52FF99BA.6040709@innovationslab.net> References: <52FDDCED020000A1000145E5@gwsmtp1.uni-regensburg.de> <52FE3FDD.9040105@innovationslab.net> <52FECC6F.5070903@ntp.org> <52FF99BA.6040709@innovationslab.net> X-KeepSent: 3B330A63:5C9D1D84-C1257C85:005A6E2F; type=4; name=$KeepSent To: Brian Haberman X-Mailer: IBM Notes Release 9.0.1 October 14, 2013 Message-ID: From: dieter.sibold@ptb.de Date: Thu, 20 Feb 2014 17:28:44 +0100 X-MIMETrack: Serialize by Router on ROSE/PTB(Release 9.0.1HF198 | January 23, 2014) at 02/20/2014 17:28:46 MIME-Version: 1.0 X-SA-Exim-Connect-IP: 192.53.103.106 X-SA-Exim-Rcpt-To: ntpwg-bounces+dieter.sibold=ptb.de@lists.ntp.org, ntpwg@lists.ntp.org X-SA-Exim-Mail-From: dieter.sibold@ptb.de X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: ntpwg@lists.ntp.org, ntpwg-bounces+dieter.sibold=ptb.de@lists.ntp.org Subject: Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org I agree with Brian. I suppose a well written BCP should be very helpful for a lot of administrators. Regards Dieter ---------------------------------- Physikalisch-Technische Bundesanstalt Dr. Dieter Sibold Q.42 - Serversysteme und Datenhaltung QM-Verantwortlicher der Stelle IT-Infrastruktur Bundesallee 100 D-38116 Braunschweig Tel: +49-531-592-84 20 E-Mail: dieter.sibold@ptb.de Von: Brian Haberman An: ntpwg@lists.ntp.org Datum: 15.02.2014 19:35 Betreff: Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack Gesendet von: ntpwg-bounces+dieter.sibold=3Dptb.de@lists.ntp.org Hi Danny, On 2/14/14 9:09 PM, Danny Mayer wrote: > On 2/14/2014 11:10 AM, Brian Haberman wrote: >> A question for the group... >> >> Do we need to codify these (and maybe other) security guidelines in >> a BCP? >> >> Brian > > For this particular attack, I'm not so sure since they involve mode 7 > packets and as far as I know only the reference implementation from > ntp.org implements them as well as mode 6 packets which are also meant > as management tools. These packets are not well documented, > particularly mode 7 and I believe only mode 6 packets are documented > in RFC 1305 which has been obsoleted by RFC 5905. Correct. There is a draft in progress to document the mode 6 packets (http://tools.ietf.org/html/draft-odonoghue-ntpv4-control-02). > > Only mode 6 and mode 7 packets could be used in an amplification > attack as all the other types return just the same size packets as the > incoming ones. It may be worthwhile to discuss the security implications of the mode 6 & 7 packets (in case another implementation decides to support them). > > There is a general need for a BCP for NTP, partiucularly over things > like Rules of Engagement and KOD packets. Some the more well-known NTP > servers (like NIST and USNO) are overwhelmed with packets, hardware > manufacturers have hard-coded IP addresses of NTP servers, and some > software just bombards NTP servers with requests. > > So I think that my answer is in general yes, but not specifically > about this. Makes sense and is the reason for my parenthetical "and maybe other" in my initial question. I would like to see some WG effort put into this type of document. Regards, Brian [Anhang "signature.asc" gel=F6scht von Dieter Sibold/PTB] _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Thu Feb 20 19:18:02 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34EE11A02BD for ; Thu, 20 Feb 2014 19:18:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sSrxF_Z77qLW for ; Thu, 20 Feb 2014 19:18:00 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id 64F191A01E7 for ; Thu, 20 Feb 2014 19:18:00 -0800 (PST) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id CA5B486D643 for ; Fri, 21 Feb 2014 03:17:56 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 8962C86D33D for ; Thu, 20 Feb 2014 20:54:22 +0000 (UTC) Received: from [2001:470:1f10:1200::2] (helo=mail.kostecke.net) by mail1.ntp.org with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WGadR-0000BX-Es for ntpwg@lists.ntp.org; Thu, 20 Feb 2014 20:54:22 +0000 Received: from steve (helo=stasis.kostecke.net) by mail.kostecke.net with local-esmtp (Exim 4.80) (envelope-from ) id 1WGadL-0000mR-D1 for ntpwg@lists.ntp.org; Thu, 20 Feb 2014 14:54:15 -0600 In-reply-to: Your message of "Thu, 20 Feb 2014 17:28:44 +0100." From: Steve Kostecke X-Editor: Vi IMproved - http://www.vim.org/ X-Mailer: nmh-1.1 - http://www.nongnu.org/nmh/ X-GPG: 1024D/37EC7A69 445D 0A12 10E4 4A0B 7352 570E 1258 534C 37EC 7A69 X-Face: h#B6a)_Q)4E"[lF?H}bIR4pK<#QL=b[;2<*t,erMjd^H-uas/DZ[<]S'1MNNX KWH!nt0ryQ5L)Ra0vL$ehnttOr&gBRLDOL1!:m`d;U!gBb]zi"9b2F_Si<'}SLOkcR ,g/fN*HAZ?'`(AV`8_ai`oYt}Z86M: X-SA-Exim-Connect-IP: 2001:470:1f10:1200::2 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: kostecke@ntp.org X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Subject: Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org dieter.sibold@ptb.de said: >I agree with Brian. I suppose a well written BCP should be very helpful >for a lot of administrators. FWIW We've been blocking mode-7 packets at the NTP Public Services Project firewall since 2009/11/08. -- Steve Kostecke NTP Public Services Project http://support.ntp.org/ Public Key at http://support.ntp.org/Users/SteveKostecke _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg