<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>It’s the other way around though isn’t it? If your NTP servers are vulnerable then you’re assisting in the attack as your NTP servers are being used to attack the victim. </div><div><br></div><div>Though I imagine that if your NTP servers were being used you’d bee seeing a large spike in your outbound UDP traffic.</div><br><div><div>On Feb 12, 2014, at 10:33 AM, Bryan Inks <<a href="mailto:Binks@keyinfo.com">Binks@keyinfo.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">Good info, I’ll definitely be looking into this.<br><br>But, I’m not being directly attacked. Internap is one of my upstreams, and they are the one that reported that they were being attacked when we called to let them know about the problem.<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div><div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"><span class="Apple-converted-space"> </span>Bill Wichers [<a href="mailto:billw@waveform.net" style="color: purple; text-decoration: underline;">mailto:billw@waveform.net</a>]<span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, February 12, 2014 10:27 AM<br><b>To:</b><span class="Apple-converted-space"> </span>Jared Mauch; Bryan Inks<br><b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:outages@outages.org" style="color: purple; text-decoration: underline;">outages@outages.org</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>RE: [outages] Internap Being DDoS'd<o:p></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">To second Jared on this one, we’ve seen a HUGE increase in NTP-based attacks over the past several weeks with our colo customers. It’s very efficient too – even a pretty low end machine can saturate a 100M link. It reminds me of SQL slammer…<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">If you haven’t yet checked that you’re safe from this you should. See:<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><a href="https://www.us-cert.gov/ncas/alerts/TA14-013A" style="color: purple; text-decoration: underline;">https://www.us-cert.gov/ncas/alerts/TA14-013A</a><o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">and<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><a href="https://www.us-cert.gov/ncas/alerts/TA14-017A" style="color: purple; text-decoration: underline;">https://www.us-cert.gov/ncas/alerts/TA14-017A</a><span style="color: rgb(31, 73, 125);"><o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);">for more info…<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> -Bill<o:p></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: rgb(31, 73, 125);"> </span></div><div style="border-style: none none none solid; border-left-color: blue; border-left-width: 1.5pt; padding: 0in 0in 0in 4pt;"><div><div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"><span class="Apple-converted-space"> </span>Outages [<a href="mailto:outages-bounces@outages.org" style="color: purple; text-decoration: underline;">mailto:outages-bounces@outages.org</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Jared Mauch<br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, February 12, 2014 1:21 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Bryan Inks<br><b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:outages@outages.org" style="color: purple; text-decoration: underline;">outages@outages.org</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [outages] Internap Being DDoS'd<o:p></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Close your NTP amplifiers and prevent the spoofing.. Will solve this one. <o:p></o:p></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><a href="http://openntpproject.org/" style="color: purple; text-decoration: underline;">Openntpproject.org</a><span class="Apple-converted-space"> </span>can help you. <br><br>Jared Mauch<o:p></o:p></div></div><div><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 11pt; font-family: Calibri, sans-serif;"><br>On Feb 12, 2014, at 12:45 PM, "Bryan Inks" <<a href="mailto:Binks@keyinfo.com" style="color: purple; text-decoration: underline;">Binks@keyinfo.com</a>> wrote:<o:p></o:p></p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Just got confirmation from Internap NOC that they are being attacked again.<o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> <o:p></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Causing quite a bit of chaos for my network in SoCal.<br><br>I’m having to route over to Level3 to minimize the issue.<o:p></o:p></div></blockquote><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="font-size: 12pt; font-family: 'Times New Roman', serif;">_______________________________________________<br>Outages mailing list<br><a href="mailto:Outages@outages.org" style="color: purple; text-decoration: underline;">Outages@outages.org</a><br><a href="https://puck.nether.net/mailman/listinfo/outages" style="color: purple; text-decoration: underline;">https://puck.nether.net/mailman/listinfo/outages</a><o:p></o:p></span></div></blockquote></div></div>_______________________________________________<br>Outages mailing list<br><a href="mailto:Outages@outages.org" style="color: purple; text-decoration: underline;">Outages@outages.org</a><br><a href="https://puck.nether.net/mailman/listinfo/outages" style="color: purple; text-decoration: underline;">https://puck.nether.net/mailman/listinfo/outages</a></div></blockquote></div><br></body></html>