Taming the 800 Pound Gorilla

Abstract

Distributed Denial of Service (DDoS) attacks based on Network Time Protocol (NTP) amplification, which became prominent in December 2013, have received significant global attention. We chronicle how this attack rapidly rose from obscurity to become the dominant large DDoS vector. Via the lens of five distinct datasets, we characterize the advent and evolution of these attacks. Through a dataset that measures a large fraction of global Internet traffic, we show a three order of magnitude rise in NTP. Using a large darknet, we observe a similar rise in global scanning activity, both malicious and research. We then dissect an active probing dataset, which reveals that the pool of amplifiers totaled 2.2M unique IPs and includes a small number of "mega amplifiers," servers that replied to a single tiny probe packet with gigabytes of data. This dataset also allows us, for the first time, to analyze global DDoS attack victims (including ports attacked) and incidents, where we show 437K unique IPs targeted with at least 3 trillion packets, totaling more than a petabyte. Finally, ISP datasets shed light on the local impact of these attacks. In aggregate, we show the magnitude of this major Internet threat, the community's response, and the effect of that response.

1000 days of UDP amplification DDoS attacks

“…Czyz et al [4] examined five datasets on NTP attacks dating from 2013 and 2014. They found that the volume of NTP attack traffic rose rapidly but fell after February 2014, possibly due to reconfiguration of NTP servers to prevent amplified reflection.…”

Rot at the roots? Examining public timing infrastructure

“…There is support through NTP to compare internal diagnostics of server synchronization quality to select a preferred peer and to inform clients, but the performance of this mechanism is variable and does not in any case constitute independent validation. From the perspective of the typical client, judging its server is inherently 1 The interesting question of exactly how large this proportion is has become much harder to answer following the blocking of diagnostic NTP queries since late 2013, due to their exploitation in DDOS attack amplification [2].…”

SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using Honeypots

“…Research shows that some botnets use recognizable values for the source port, TTL, or DNS values [13]. For example, the ports 80 and 123 are often found paired with NTP (port 123) attacks [12], [13], [17] and make up more than 50% of the attacks together. Protocol specific observations show that source port selection differs among protocols [16]: attacks using CharGen, QOTD, RIP, and SSDP exhibit a hard-coded, stable paired port almost exclusively while NTP and DNS attacks show a larger range of randomized ports (about 50%).…”

“…This observation confirms common expectations, which assume attackers choose protocols that allow for high amplification and provide a rich amplifier infrastructure. NTP, for example, does not only provide the highest amplification factor and many amplifiers but also megaamplifiers [17], i.e., hosts that exhibit a significantly larger amplification factor due to their configuration, making this protocol most appealing for attacks.…”