<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:black;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:black'>Dear Sean<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Thanks for your email and additional information, sounds exactly like what we have seen in the past, in fact we have seen almost 100% only NTP reflection attacks originating from within Australia.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>I was going to write a blog article regarding this however just have not got around to it… Out of interest in what is the size of the inbound payload of each packet ? ?<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Kindest Regards<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><div><p class=MsoNormal><b><span style='font-family:"Verdana","sans-serif";color:black'>James Braunegg<br></span></b><b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>P:</span></b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> 1300 769 972 | <b>M:</b> 0488 997 207 | <b>D:</b> (03) 9751 7616</span><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>E:</span></b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> </span><span style='color:black'><a href="mailto:james.braunegg@micron21.com"><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>james.braunegg@micron21.com</span></a></span><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> | <b>ABN:</b> 12 109 977 666 <br><b>W:</b> <a href="http://www.micron21.com/ddos-protection"><span style='color:black'>www.micron21.com/ddos-protection</span></a> <b>T:</b> @micron21<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><br><img border=0 width=250 height=39 id="_x0000_i1030" src="cid:image001.jpg@01CF28D6.B352E3A0" alt="Description: Description: Description: Description: M21.jpg"><br></span><span lang=EN-AU style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.</span><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Sean K. Finn [mailto:sean.finn@ozservers.com.au] <br><b>Sent:</b> Thursday, February 13, 2014 4:05 PM<br><b>To:</b> James Braunegg; ausnog@lists.ausnog.net<br><b>Subject:</b> RE: NTP Reflection coming in over Equinix IX<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>G’day James,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Firstly thank you for sharing.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We’ve had in the order of 100-200 hosts being reflectors in the past few weeks launching outbound, however this is the first time we’ve been on the receiving end of an NTP.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>What makes this stand out from the every-day DDOS is there were many, many hosts coming in across peering.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We’re dropping the ntp traffic at the firewalls internally, it’s not causing an issue once it gets to us, more of a curiosity that so many Australian connected peers are still reflecting, and importantly haven’t yet been exploited or cleaned up.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><br>Thankfully we’ve been able to clean up the hosts on our network one by one as they launch attacks outbound. (Much like in years past when DNS amplification was all the rage).<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>We’ve noticed a few older ESXi hosts have ntp enabled by default and are susceptible as well, these boxes only started participating in outbound attacks within the last two weeks though, as well as Junipers reflecting.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Prior to that it was mainly older linux hosts.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I’m guessing there are slightly different permutations to the NTP attack and its being refined slowly over time to identify the ever-diminishing reflection fruit.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>-Another oddity:<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>The SOURCE IP’s were all NTP, UDP port 123.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>The RECEIVING IPs at this end were destination PORT 80, UDP.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>iknowrite.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Sean.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> James Braunegg [<a href="mailto:james.braunegg@micron21.com">mailto:james.braunegg@micron21.com</a>] <br><b>Sent:</b> Thursday, February 13, 2014 2:52 PM<br><b>To:</b> Sean K. Finn; <a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a><br><b>Subject:</b> RE: NTP Reflection coming in over Equinix IX<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:black'>Dear Sean<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>If you can filter on packet size you should find the attack request for the inbound NTP request is 50bytes in size, if you can drop this inbound request via pattern matching this will stop the request attack traffic in its place from reaching anything downstream !<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>It also is important to understand if you are being targeted by a NTP attack or do you have hosts within your network precipitating in an attack.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>If you need any help just ask !<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Kindest Regards<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><div><p class=MsoNormal><b><span style='font-family:"Verdana","sans-serif";color:black'>James Braunegg<br></span></b><b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>P:</span></b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> 1300 769 972 | <b>M:</b> 0488 997 207 | <b>D:</b> (03) 9751 7616<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>E:</span></b><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> </span><a href="mailto:james.braunegg@micron21.com"><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>james.braunegg@micron21.com</span></a><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> | <b>ABN:</b> 12 109 977 666 <br><b>W:</b> </span><a href="http://www.micron21.com/ddos-protection"><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>www.micron21.com/ddos-protection</span></a><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'> <b>T:</b> @micron21<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><br><img border=0 width=250 height=39 id="_x0000_i1025" src="cid:image001.jpg@01CF28D6.B352E3A0" alt="Description: Description: Description: Description: M21.jpg"><br></span><span lang=EN-AU style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'>This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.</span><span style='font-size:8.0pt;font-family:"Verdana","sans-serif";color:black'><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> AusNOG [</span><a href="mailto:ausnog-bounces@lists.ausnog.net"><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>mailto:ausnog-bounces@lists.ausnog.net</span></a><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>] <b>On Behalf Of </b>Sean K. Finn<br><b>Sent:</b> Thursday, February 13, 2014 3:37 PM<br><b>To:</b> </span><a href="mailto:ausnog@lists.ausnog.net"><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>ausnog@lists.ausnog.net</span></a><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><br><b>Subject:</b> [AusNOG] NTP Reflection coming in over Equinix IX<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hey All,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I never thought I’d see the day, we’re seeing local NTP Reflection attacks come in across Equinix peering!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thankfully they are very small amounts of traffic but you can see the traffic jump percentage wise.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><img border=0 width=596 height=210 id="Picture_x0020_1" src="cid:image002.png@01CF28D6.B352E3A0" alt="cid:image002.png@01CF28CC.B4ED8C60"><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU>Does anyone have any mitigation stategies across the Equinix IX . (Apart from obvious, i.e. contacting the peer AS’s to asking them to nice mitigate at their end and pray, or droping prefix from Equinix completely.)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU>PS Anyone else on Equinix Syd if you’re smashing outbound on NTP please check </span><span lang=EN-AU style='font-family:Wingdings'>J</span><span lang=EN-AU><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU>This is the first time we’ve seen reflection attack across peering!<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU>What I once considered safe harbour has now been compromised.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU>Kind Regards,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU>Sean Finn,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU>Oz Servers.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-AU><o:p> </o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span lang=EN-AU style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=1 width="100%" noshade style='color:#D0D3DD' align=center></span></div><p class=MsoNormal align=center style='text-align:center'><span lang=EN-AU style='font-size:9.0pt;font-family:"Tahoma","sans-serif";color:silver'>Premium Australian Hosting Solution Specialists</span><span lang=EN-AU style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span lang=EN-AU style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=1 width="100%" noshade style='color:#D0D3DD' align=center></span></div><table class=MsoNormalTable border=0 cellpadding=0 width="96%" style='width:96.9%'><tr><td style='padding:.75pt .75pt .75pt .75pt'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Sean Finn, </span></b><span style='font-size:7.0pt;font-family:"Tahoma","sans-serif"'>BInfTech(NetSys)Qld.UT</span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Oz Servers</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><br>e: </span><a href="mailto:sean.finn@ozservers.com.au"><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:blue'>sean.finn@ozservers.com.au</span></a><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><br><b>w: </b></span><a href="http://www.ozservers.com.au/" title="http://www.ozservers.com.au/"><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:blue'>http://www.ozservers.com.au</span></b></a><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><br><b>p: 1300 13 89 69</b></span><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></td><td style='padding:.75pt .75pt .75pt .75pt'><p class=MsoNormal align=right style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:right'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><img border=0 width=140 height=70 id="Picture_x005f_x005f_x005f_x0020_2" src="cid:image003.gif@01CF28D6.B352E3A0" alt=ozlogo><o:p></o:p></span></p></td></tr></table><p class=MsoNormal><o:p> </o:p></p></div></body></html>