NTP DRDoS Attack Vulnerability and Mitigation

Abstract:

The Network Time Protocol (NTP) is used to synchronize clocks of various computer devices such as personal computers, tablets, and phones based their set time zones. The network of devices that use these NTP servers form a huge distributed network that attracted a number of attacks from late 2013 towards early 2014. This paper presents a hands-on test of the Distributed Reflection Denial of Service (DRDoS) attack by the monlist command, provides more vulnerability in the protocol, and offers mitigation to these vulnerabilities. A Kali Linux server was used to test the monlist command on its localhost. The results showed that a request with a size of 234 bytes got a response of 4,680 bytes. A busy NTP server can return up to 600 addresses which were theoretically calculated to return approximately 48 kilobytes in 100 packets. Consequently, this results in an amplification factor of 206×. The knowledge of the way the attack can be propagated was an important step in thwarting the attack and mitigating more such threats in the same protocol.

• Periodical: Applied Mechanics and Materials (Volumes 644-650)
• Pages: 2875-2880
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.644-650.2875
• Online since: September 2014
• Authors: A. Alfraih Abdulaziz Nasser*, Wen Bo Chen
• Keywords: Denial of Service, Network Security, Network Time Protocol, Server

References

[1] C. Kaufman, Perlman, R., & Speciner, M. Network security: private communication in a public world,. Prentice Hall Press, (2002).

[2] J. Kristoff. NTP Reflections,. Retrieved on 8th June 2014 from <https: /labs. ripe. net/Members/mirjam/ntp-reflections>, (2014).

[3] J. D. Guyton, & Schwartz, M. F. Experiences with a survey tool for discovering network time protocol servers,. In USENIX Summer (pp.257-265), (1994).

DOI: 10.21236/ada453548

[4] Network Time Protocol,. Security Notice,. Retrieved on 8th June 2014 from <http: /support. ntp. org/bin/view/Main/SecurityNotice#DRDoS_Amplification_Attack_using>, (2014).

[5] Stallings, William. Network and internetwork security: principles and practice,. Prentice-Hall, Inc., (1995).

[6] US-CERT. NTP Amplication Attacks Using CVE-2013-5211,. Retrieved on 8th June 2014 from <https: /www. us-cert. gov/ncas/alerts/TA14-013A> (2014).

[7] J. Cumming. Understanding and Mitigating NTP-based DDoS attacks,. Retrieved on 8th June 2014 from <http: /blog. cloudflare. com/understanding-and-mitigating-ntp-based-ddos-attacks>, (2014).

[8] S. Alawi. NTP reflection attack,. Retrieved on 8th June 2014 from <https: /isc. sans. edu/diary/NTP+reflection+attack/17300>, (2013).

[9] M. Prince. Technical Details Behind a 400Gbps NTP Amplification DDoS Attack,. Retrieved on 8th June 2014 from < http: /blog. cloudflare. com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack >, (2014).

[10] C. Janet. Seven steps to secure ntp servers from DDoS attacks,. Retrieved on 8th June 2014 from <https: /community. ja. net/library/janet-services-documentation/seven-steps-secure-ntp-servers-ddos-attacks>, (2014).

[11] Bencsáth, Boldizsár, and István Vajda. Protection against DDoS attacks based on traffic level measurements., In 2004 International Symposium on Collaborative Technologies and Systems, pp.22-28. (2004).

[12] Mills, David. Network Time Protocol (Version 3) specification, implementation and analysis., (1992).