Analysis of NTP reflection amplification attacks

Some time ago, the NTP amplification attack was very active. Let's analyze it briefly.

Attack principles:

1,ExploitationUDPThe natural weakness of the Protocol, that is, you can directlyClientSend data;

2,InternetThere are a large number of open and distributedNtpserverTo respond to the synchronization request.

3, Ratio DNS The biggest difference between reflection amplification and attack power is NTP Unique Monlist Function, (Monlist Command to obtain and target NTP server Last Synchronization 600 Clients IP . This means that a small request packet can obtain a large number of activities. IP Address composition continuity UDP Package ).

 

Attack implementation:

1,AllBotsSourceIPDisguise as a victimIPInNTPThe query results returned during the query are directly returned to the victim;

2,NTP responsePacket ratioNtprequestIt is many times larger, achieving a magnified effect.

 

Defense mitigation methods:

1,UpgradeNTP serverVersion, disableMonlistFunction or network boundaryACLFilter relatedIPPort.

2,This kind of trend10g,100 GBAttacks, more should beISPAnd hackers. For example:

A,Carrier should be enabled on the whole networkUrpfFunction, which can reject various spoofing sources to the maximum extent.IPHowever, due to the domestic Internet environment, many asymmetric routes cannot be effectively implemented.

B,Currently, carriers defend against attacks similar to this type of attacks, which are basically monitored by the botnet monitoring system or attacked when an attack is detected.IPClean or seal directlyIP.

 

Summary:

 

Nowadays, Internet attacks, including network attacks and application attacks, are becoming more and more harmful. In the future, we need to strengthen our research on new technologies and types of attacks, in turn, they consolidate the security of their networks, systems, and applications.

This article from the "the brightest star in the night sky" blog, please be sure to keep this source http://wangxl.blog.51cto.com/621714/1439459