Re: [Ntp] Details of the fragmentation attacks against NTP and port randomization

Yes. PoC exists. It's run from intermediaries just like smtp spoofing is, and while arrogance wants to push this as very difficult it's not.

Sent from my HTC, so please excuse any typos.

----- Reply message -----
From: "Majdi S. Abbas" <msa@latt.net>
To: "AskBjørn Hansen" <ask@develooper.com>
Cc: <ntp@ietf.org>, "Danny Mayer" <mayer@pdmconsulting.net>
Subject: [Ntp] Details of the fragmentation attacks against NTP and port randomization
Date: Wed, Jun 5, 2019 19:09

On Wed, Jun 05, 2019 at 10:45:14AM +0800, Ask Bjørn Hansen wrote:
> This doesn’t seem right. There are much much less NTP servers in the 
> world than there are clients. Even an attacker wildly guessing will 
> have a limited scope of guessing (versus “every possible IP”).

You're still going to have to guess the entire set of servers
the client is using, get them to accept small fragmented packets, with
an invalid of zero checksum...and do this for a minimum of 8 poll 
intervals in order to fool the discipline filters.  So you have to 
correctly predict the timing, and try to send additional fragments...
while the host is still processing the UDP frame.

This does not appear to be anything but a very theoretical 
attack at this point -- does anyone have a proof of concept?

Additionally: Can anyone think of a reason an implementation
should accept an additional fragment if the MF bit was not set in the
first packet?  (Particularly an overlapping fragment, when we are not
expecting any fragments at all?)

And does that behavior exist in the wild?

Thanks,

--msa

_______________________________________________
ntp mailing list
ntp@ietf.org
https://www.ietf.org/mailman/listinfo/ntp