NTP DDoS Vulnerability Active Directory

hello,

our isp has provided warnings ntp ddos attacks against our network. have active directory @ server2008 r2 schema version, number of our dc's @ server 2003 sp2. have read ace fekay's response under thread "nntp monlist ddos attack: windows server vulnerable?" however, wondering if there has been additional research done microsoft on issue in view of more pointed warnings serverity of attacks.

here our isp's guidance:

*********beginning of isp guidance**********

"subject: increase in ntp ddos attacks targeting schools

 

center internet security (cis) aware of @ least 4 network time protocol (ntp) distributed denial of service (ddos) attacks targeting school districts in 2014, indicating possible trend of k-12 school district targeting ntp ddos attacks.

 

ntp protocol syncs clocks of networked machines , runs on port 123/udp. obscure command, “monlist,” allows requesting computer receive information regarding last 600 connections ntp server. ntp ddos attack uses ddos reflection , amplification: malicious actor spoofs victim's ip address , uses monlist command request ntp server send large amount of data victim. since requesting attacker sends request ntp server smaller amount of information returned, amplifies effect on victim.

 

recommendations:

•          protective measures avoid participating in attack:
  •    upgrade ntp servers version 4.2.7 or later, removes monlist command entirely or implement version of ntp not utilize monlist command, such openntpd.
  •    if server cannot upgraded, monlist query feature can disabled adding “disable monitor” ntp.conf file , restarting ntp process.
  •    implement firewall rules restrict traffic ntp server unauthorized sources.
  •    instructions determining if ntp server vulnerable available @ openntpproject.org.
    •          ntp ddos attack remediation measures:
  •    establish , maintain effective partnerships internet service provider (isp) or upstream providers, may able assist in attack mitigation.
  •    provide attacking ip addresses isp in order implement restrictions @ level. has been reported filtering traffic @ upstream provider level source port 123 , packet size restrictions (i.e. 468 bytes, 482bytes) remediating attack.
  •    establish relationship company offers ddos mitigation services.
  •    apply firewall filter restricts traffic trusted addresses (including loopback address).
  •    enable firewall logging of accepted , denied traffic in order determine ddos may originating."

*********end of isp guidance**********

additionally, here link article juniper networks dealing in part active directory vulnerabilities: 

http://www.juniper.net/security/auto/vulnerabilities/vuln10980.html

our pdc emulator dc using ntp , external time servers are: north-america.pool.ntp.org,0x9 tock.usno.navy.mil,0xa

what steps need take respect active directory time service on pdc emulator , other dc's protect our network ddos ntp attacks? have fortigate 800-c firewall.

thanks,

scott mcintosh

hi,

have not received such feedbacks of ntp ddos attack against windows server. w32tm mechanism, use internal time source exclude possibility of vulnerability or assign internal server out time source synching, on behalf of pdc.

regards, brian

---

please remember click “mark answer” on post helps you, , click “unmark answer” if marked post not answer question. can beneficial other community members reading thread.

Windows Server  >  Directory Services