NTP attacks - threshold-based blocks?

[aaronm]

Our campus has been getting a lot of NTP DDoS attacks of late.  While the simple solution would be to shut it down except for necessary systems, the problem (as per usual in public-sector) is that everyone seems to want to run something that uses it and complains if we start blocking.

Looking at the attacks, it's very easy to see the difference between a legitimate NTP query (1 or 2 packets) and an attack.   My question is: Is there a way to define a threshold-based filter that will drop or block the attack as with brute-force type attacks?  That would solve all of the issues.

[Phoenix]

At this stage, it is wise to get packet captures and share the problem scenario and open the case. The logs would be analysed for the threat pattern and frequency and they can come up with a solution.

Thanks

[eDub]

NTP reflection attacks are occurring frequently these days. The safest approach is lock down who you obtain NTP from (I do this on my border router). Short of that, the other way to approach it is  create a threat exception action to block instead of alert:

Name

NTP Reserved Mode Denial of Service Vulnerability

ID

33273

Description

NTP is prone to a DoS vulnerability while parsing certain crafted NTP requests.The vulnerability is due to the lack of proper checks in the NTP request, leading to an exploitable DoS. An attacker could exploit the vulnerability by sending a crafted NTP request. A successful attack could lead to remote DoS with the privileges of the server.

Severity

CVE

CVE-2009-3563

Bugtraq ID

37225

Vendor ID

Reference

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3563

[rmonvon]

Hi...You can define a custom threat signature and specify the time attribute as described.  The custom signature can be completely new, or based on combination of existing threat signatures.

Re: How to shun/block an IP address for a period of time

[aaronm]

The problem with this signature is that it's not what's being triggered in this case.  In fact, none of the NTP vulnerabilities were getting triggered.  It showed up instead as traffic and application "NTP".  Blocking anything but legitimate is easier said than done here - being a university with a lot of scientists and research going on, it may take the security teams weeks or months to determine what is officially needed vs. wanted.

[aaronm]

For a custom signature, only ever built one that used existing vulnerabilities.  Since those are not triggering in this case, how could I define a new one based simply on the fact that it is recognized as a NTP application?