Re: [ntpwg] Antw: Attackers use NTP reflection in huge DDoS attack

[Brian Haberman <[e-mail]>]

Hi Danny,

On 2/14/14 9:09 PM, Danny Mayer wrote:
> On 2/14/2014 11:10 AM, Brian Haberman wrote:
>> A question for the group...
>>
>> Do we need to codify these (and maybe other) security guidelines in
>> a BCP?
>>
>> Brian
> 
> For this particular attack, I'm not so sure since they involve mode 7
> packets and as far as I know only the reference implementation from
> ntp.org implements them as well as mode 6 packets which are also meant
> as management tools. These packets are not well documented,
> particularly mode 7 and I believe only mode 6 packets are documented
> in RFC 1305 which has been obsoleted by RFC 5905.

Correct.  There is a draft in progress to document the mode 6 packets
(http://tools.ietf.org/html/draft-odonoghue-ntpv4-control-02).

> 
> Only mode 6 and mode 7 packets could be used in an amplification
> attack as all the other types return just the same size packets as the
> incoming ones.

It may be worthwhile to discuss the security implications of the mode 6
& 7 packets (in case another implementation decides to support them).

> 
> There is a general need for a BCP for NTP, partiucularly over things
> like Rules of Engagement and KOD packets. Some the more well-known NTP
> servers (like NIST and USNO) are overwhelmed with packets, hardware
> manufacturers have hard-coded IP addresses of NTP servers, and some
> software just bombards NTP servers with requests.
> 
> So I think that my answer is in general yes, but not specifically
> about this.

Makes sense and is the reason for my parenthetical "and maybe other" in
my initial question.

I would like to see some WG effort put into this type of document.

Regards,
Brian

_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg