EVE General Discussion

People are playing with a new DDoS tactic, abusing the Network Time Protocol to amplify DDoS attacks. Bandwidths of well over 400Gb/s are being directed at popular websites and hosts. Expect crappy internet for a few days until this threat is neutralized.

The attack is based on a very simple premise:

NTP servers that respond to MONLIST Mode 7 command requests will generate responses that are 5,500 times bigger in size than the requests. Paired with the ability to spoof network addresses globally, this attack allows the attacker to send a huge number of those requests toward a number of known public NTP servers and solicit a huge response toward the spoofed address of the (source) victim.

There are three key points regarding this vulnerability:

The server that is "open" for NTP Mode 7 requests can receive a huge number of requests and be forced to generate responses that are up to 5,500 times larger than original requests.
The vulnerable NTP servers are used as UDP reflectors in attacks against targeted destinations that may or may not have NTP servers or NTP clients on their networks. Regardless, these targets receive a flood of unsolicited return UDP traffic directed toward them at the destination port of the attacker's choice.
The network that is being used as a source (victim) in a spoofed barrage of NTP requests to such servers will find itself under a huge flow of unsolicited NTP responses.

Keep in mind that, although the characteristics of this attack use NTP packets, this series of attacks is in no way different from typical reflected DDoS amplification attacks. Networks are being sent a flood of unsolicited packets that can grow significantly in both size and speed.