RE: NIST NTP servers

["Chuck Church" <chuckchurch () gmail com>]

True, but I did mention verifying packet sources.  That needs to happen everywhere, and it's not hard to do.  Just 
getting everyone to do it is tough.

Chuck

-----Original Message-----
From: Allan Liska [mailto:allan () allan org] 
Sent: Tuesday, May 10, 2016 10:40 AM
To: Chuck Church <chuckchurch () gmail com>; 'Majdi S. Abbas' <msa () latt net>; nanog () nanog org
Subject: RE: NIST NTP servers



On 5/10/2016 at 10:30 AM, "Chuck Church" <chuckchurch () gmail com> wrote:

> It doesn't really.  Granted there are a lot of CVEs coming out for NTP 
> the last year or so.  But I just don't think there are that many 
> attacks on it.
> It's just not worth the effort.  Changing time on devices is more an 
> annoyance than anything, and doesn't necessarily get you into a device.
> Sure you can hide your tracks a little by altering time in logs and 
> altering it back, but that's more of an in-depth nation-state kind of 
> attack, not going to be a script kiddie kind of thing.  Just follow the 
> best practices for verifying packet sources and NTP security itself, 
> and you should be ok.
>
> Chuck

I would argue that the fact the NTP can, and has been, be used in DDoS amplification attacks is a serious concern for 
using protocol going forward.



allan