Re:Understanding and mitigating NTP-based DDoS attacks
by yourad_io on Friday January 10, 2014 @07:03AM
(#7036219)
Well, yes and no. They could make the argument that in "internet scale" (sic) that still qualifies as "few" (at least when compared to the number of open DNS resolvers).
On the other hand, the number of open DNS resolvers used in the attacks described in the presentation (slides 7/8) were around 30K, and with a much smaller amplification factor, so these numbers can still do some damage.
It would be interesting to know if there have been "hybrid" DDOS attacks, utilizing multiple spoofed-origin+amplification methods.
Re:Understanding and mitigating NTP-based DDoS attacks
by nobodyshere on Friday January 10, 2014 @07:00AM
(#7036211)
One of our instances rented on Hetzner got involved a few days ago. 80GB of outgoing traffic. We got blocked swiftly and unblocked quite soon after fixing the problem.
“Luckily, there are few open SNMP servers on the Internet and SNMP usually requires authentication (although manly are poorly secured).”
A 2012 study revealed 13k+ open SNMP servers amongst 25 million Dutch IPs scanned [1].
[1] [Dutch] http://www.itsx.com/files/2012-11-SNMP-paper-v1.0.pdf
On the other hand, the number of open DNS resolvers used in the attacks described in the presentation (slides 7/8) were around 30K, and with a much smaller amplification factor, so these numbers can still do some damage.
It would be interesting to know if there have been "hybrid" DDOS attacks, utilizing multiple spoofed-origin+amplification methods.
Oh well, at least it only affect our installation and should not affect the customer network more than that. They have a stupid amount of capacity.
What is the size of a TAICLOCK response? (TAICLOCK is a more precise NTP alterative.)