{"data":{"case":{"actions":{"de":["Aktualisiere ntpd auf die neueste Version der Reihe **4.2.8**: Seit der Entwicklungsversion 4.2.7p26 beantwortet ntpd keine monlist-Anfragen mehr.","Wenn du nicht aktualisieren kannst, ergänze in der ntp.conf die Zeilen `restrict default` für IPv4 und IPv6 um `noquery`, um alle Statusabfragen zu sperren. Füge sonst zumindest `disable monitor` hinzu, um monlist abzuschalten.","Teste deine öffentlichen Zeitserver von außerhalb deines Netzwerks, etwa mit dem Nmap-Skript `ntp-monlist`: Ein sicherer Server meldet einen Fehler oder antwortet gar nicht.","Prüfe auch Router, Firewalls und andere Geräte mit eingebautem Zeitserver. Sperre NTP-Anfragen aus dem Internet, wo kein Client von außen sie braucht.","Wenn du ein Netzwerk betreibst, verwirf an seinem Rand Pakete mit gefälschten Absenderadressen, wie in **BCP 38** beschrieben. So kann niemand in deinem Netzwerk solche Angriffe starten."],"en":["Update ntpd to the latest **4.2.8** release: since development version 4.2.7p26, ntpd no longer answers monlist requests.","If you cannot update, add `noquery` to the `restrict default` lines for IPv4 and IPv6 in ntp.conf to block all status queries. Otherwise, at least add `disable monitor` to switch off monlist.","Test your public time servers from outside your network, for example with the Nmap script `ntp-monlist`: a safe server returns an error or no reply.","Check routers, firewalls and other devices with a built-in time server too. Block NTP requests from the internet where no outside client needs them.","If you run a network, drop packets with forged sender addresses at its edge, as described in **BCP 38**. That way, nobody in your network can launch such attacks."]},"criteria":{"damage":{"de":"Eine Gesamtzahl zum Schaden gibt es nicht. Die Quellen belegen keinen Ausfall kritischer Dienste. Bei einem regionalen Netzbetreiber in Michigan steigerten die Angriffe den Datenverkehr um mehr als 2 % und erhöhten die Gebühren für seine eigene Internetanbindung (Taming the 800 Pound Gorilla, 2014).","en":"No total of the damage exists, and the sources document no outage of critical services. At a regional network in Michigan, the attacks added more than 2 % to its traffic and raised the fees it paid for its own internet connection (Taming the 800 Pound Gorilla, 2014).","met":false},"exploitation":{"de":"Binnen 15 Wochen trafen Angriffe 437.000 Adressen in 11.558 Netzwerken und 184 Ländern mit 2,92 Billionen Paketen (Taming the 800 Pound Gorilla, 2014).","en":"Within 15 weeks, attacks hit 437,000 addresses in 11,558 networks and 184 countries with 2.92 trillion packets (Taming the 800 Pound Gorilla, 2014).","met":true},"reach":{"de":"Wöchentliche Scans des gesamten Internets fanden 1.405.186 verwundbare NTP-Server am 10. Januar 2014 und 2.166.097 verschiedene Adressen in 15 Wochen (Taming the 800 Pound Gorilla, 2014).","en":"Weekly scans of the whole internet found 1,405,186 vulnerable NTP servers on January 10, 2014, and 2,166,097 different addresses over 15 weeks (Taming the 800 Pound Gorilla, 2014).","met":true},"response":{"de":"Forscher, CERTs und Netzbetreiber beteiligten sich länderübergreifend an den Aufräumarbeiten. Das ganze Internet wurde wöchentlich gescannt. Die Betreiber wurden über CERTs und direkt benachrichtigt. Zugleich sank die Zahl der verwundbaren Server binnen rund drei Monaten um 92 %. In jeder Weltregion fiel sie um 63–97 % (Taming the 800 Pound Gorilla, 2014). US-CERT und CERT/CC gaben Warnungen heraus (US-CERT, CERT/CC).","en":"Researchers, CERTs and network operators joined the cleanup across countries. Weekly internet-wide scans and notifications, through CERTs and directly to operators, accompanied a 92 % drop in vulnerable servers within about three months. Every region of the world saw a decline of 63–97 % (Taming the 800 Pound Gorilla, 2014). US-CERT and CERT/CC issued warnings (US-CERT, CERT/CC).","met":true}},"cves":["CVE-2013-5211"],"cvss":5,"cvss_version":"2.0","cwe":"CWE-20","dates":[{"date":"2010-04-24","key":"patched"},{"date":"2013-12-30","de":"Während einer Welle von DDoS-Angriffen erhält die Sicherheitslücke die Nummer CVE-2013-5211","en":"Amid a wave of DDoS attacks, the flaw receives the number CVE-2013-5211"},{"date":"2014-01-10","de":"Der erste wöchentliche Scan des Internets findet 1.405.186 verwundbare Server","en":"The first weekly scan of the internet finds 1,405,186 vulnerable servers"},{"date":"2014-01-13","de":"US-CERT warnt vor NTP-Verstärkungsangriffen","en":"US-CERT warns of NTP amplification attacks"},{"date":"2014-02-10","de":"Ein Angriff mit fast 400 Gbit/s von 4.529 NTP-Servern trifft ein Ziel im Netzwerk von Cloudflare","en":"An attack of almost 400 Gbps from 4,529 NTP servers hits a target in Cloudflare's network"},{"date":"2014-02-11","de":"Der NTP-Verkehr erreicht seinen Höchststand mit etwa 1 % des gesamten Internetverkehrs","en":"NTP traffic peaks at about 1 % of all internet traffic"},{"date":"2014-04-18","de":"Noch 106.445 verwundbare Server sind übrig, 92 % weniger als im Januar","en":"106,445 vulnerable servers are left, 92 % fewer than in January"},{"date":"2014-12-19","de":"ntp 4.2.8 ist die erste stabile Version ohne monlist","en":"ntp 4.2.8 is the first stable version without monlist"}],"de":{"credit":"Im Hinweis des NTP-Projekts nicht genannt; breite Aufmerksamkeit bekam die Lücke erst durch die Angriffe im Dezember 2013","fixed":"ntpd 4.2.7p26, eine Entwicklungsversion (24. April 2010); die erste stabile Version ohne monlist ist ntp 4.2.8 (19. Dezember 2014)","product":"ntpd, die Zeitserver-Software des NTP-Projekts, und Geräte, die sie nutzen","summary":"Ein Diagnosebefehl in NTP-Zeitservern beantwortete eine winzige Anfrage mit einer Liste von bis zu 600 Adressen. So konnten Angreifer mit gefälschten Absenderadressen mehr als eine Million Server als Verstärker für DDoS-Angriffe nutzen."},"disclosed":"2014-01-02","en":{"credit":"Not named in the NTP project's notice; the flaw drew wide attention only through the attacks of December 2013","fixed":"ntpd 4.2.7p26, a development version (April 24, 2010); the first stable version without monlist is ntp 4.2.8 (December 19, 2014)","product":"ntpd, the time server software of the NTP project, and devices that use it","summary":"A diagnostic command in NTP time servers answered a tiny request with a list of up to 600 addresses. This let attackers with forged sender addresses use more than a million servers as amplifiers for DDoS attacks."},"figures":[{"de":"verschiedene Adressen verwundbarer NTP-Server in 15 Wochen Scans","en":"different addresses of vulnerable NTP servers in 15 weeks of scans","value":"2,166,097"},{"de":"Adressen in 184 Ländern binnen 15 Wochen von Angriffen getroffen","en":"addresses hit by attacks within 15 weeks, in 184 countries","value":"437,000"},{"de":"des gesamten Internetverkehrs entfiel auf dem Höhepunkt im Februar 2014 auf NTP, nach 0,001 % im November 2013","en":"of all internet traffic was NTP at its peak in February 2014, up from 0.001 % in November 2013","value":"1 %"},{"de":"weniger verwundbare Server am 18. April 2014 als beim ersten Scan im Januar","en":"fewer vulnerable servers on April 18, 2014, than in the first scan in January","value":"92 %"}],"key":"ntp-monlist","name":"NTP monlist","product":"NTP (ntpd)","sources":[{"de":"Taming the 800 Pound Gorilla: The Rise and Decline of NTP DDoS Attacks, ACM Internet Measurement Conference (2014, PDF)","title":"Taming the 800 Pound Gorilla: The Rise and Decline of NTP DDoS Attacks, ACM Internet Measurement Conference (2014, PDF)","url":"https://conferences.sigcomm.org/imc/2014/papers/p435.pdf"},{"de":"NTP-Projekt: Sicherheitshinweis zu Bug 1532, Verstärkungsangriff über den Befehl monlist","title":"NTP project: security notice on bug 1532, amplification attack using the monlist command","url":"https://www.ntp.org/support/securitynotice/ntpbug1532/"},{"de":"NTP-Projekt: Zeitleiste der Veröffentlichungen, mit ntp 4.2.8 (19. Dezember 2014)","title":"NTP project: release timeline, with ntp 4.2.8 (December 19, 2014)","url":"https://www.ntp.org/dev/releasetimeline/"},{"de":"NVD: CVE-2013-5211","title":"NVD: CVE-2013-5211","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5211"},{"de":"Mailingliste oss-security: Anfrage nach einer CVE-Nummer für das monlist-DDoS-Problem (30. Dezember 2013)","title":"oss-security mailing list: request for a CVE number for the monlist DDoS issue (December 30, 2013)","url":"https://www.openwall.com/lists/oss-security/2013/12/30/6"},{"de":"Mailingliste oss-security: CVE-2013-5211 vergeben (30. Dezember 2013)","title":"oss-security mailing list: CVE-2013-5211 assigned (December 30, 2013)","url":"https://www.openwall.com/lists/oss-security/2013/12/30/7"},{"de":"CERT/CC-Schwachstellenhinweis VU#348126","title":"CERT/CC vulnerability note VU#348126","url":"https://www.kb.cert.org/vuls/id/348126"},{"de":"US-CERT-Warnung TA14-013A: NTP-Verstärkungsangriffe über CVE-2013-5211","title":"US-CERT alert TA14-013A: NTP amplification attacks using CVE-2013-5211","url":"https://www.cisa.gov/ncas/alerts/TA14-013A"},{"de":"US-CERT-Warnung TA14-017A: Verstärkungsangriffe über UDP","title":"US-CERT alert TA14-017A: UDP-based amplification attacks","url":"https://www.cisa.gov/ncas/alerts/TA14-017A"},{"de":"ICS-CERT-Hinweis ICSA-14-051-04: NTP-Reflexionsangriff","title":"ICS-CERT advisory ICSA-14-051-04: NTP reflection attack","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-051-04"},{"de":"Cloudflare: technische Details zu einem NTP-Verstärkungsangriff mit 400 Gbit/s (2014)","title":"Cloudflare: technical details behind a 400 Gbps NTP amplification DDoS attack (2014)","url":"https://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack/"}],"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","year":2014}},"description":"From December 2013, attackers abused a diagnostic command in NTP time servers to multiply their attack traffic. How it worked, and how the internet cleaned up.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/data/method/","source":"https://crackthe.net/","text":"In December 2013, attackers began to misuse ordinary time servers for distributed denial-of-service (DDoS) attacks. These knock a target offline by flooding it with more traffic than its connection can carry. The attackers used monlist, a diagnostic command in ntpd, the server software of the NTP project. NTP, the Network Time Protocol, keeps the clocks of computers and network devices in sync. A measurement study found vulnerable servers at 2.2 million internet addresses and counted 437,000 attacked addresses in 15 weeks.\nHow it worked Time servers answer short requests from devices that want to set their clocks. For diagnostics, ntpd also kept a list of the clients that had contacted it most recently. The monlist command returned this list, up to 600 entries, to anyone who asked. According to US-CERT, the US government\u0026rsquo;s computer emergency team, older devices with NTP had the command switched on by default.\nNTP uses UDP, a way of sending single data packets without first setting up a connection. So the server cannot check who really sent a request. An attacker writes the victim\u0026rsquo;s address into the request as the sender, and the server sends its answer there. A monlist answer can be far larger than the request. This amplifies the attack: the attacker sends a little data, and the victim receives a lot.\nUS-CERT gives NTP an amplification factor of 556.9: the answer carries 556.9 times the data of the request. It counts only the content of the packets. For DNS, the internet\u0026rsquo;s address system, it gives 28 to 54. The study described below counted whole packets. It found that a typical vulnerable server returned about 4 times the data of the request, and a quarter at least 15 times. A few “mega amplifiers” answered a single packet with gigabytes. The largest sent more than 136 gigabytes in one day, probably because of a network loop.\nBecause the floods came from thousands of legitimate servers, they were hard to block. The servers were not broken into; they were used as tools against others.\nAttackersends a tiny monlist request with the victim\u0026#39;s address as sender NTP serveranswers with its list of up to 600 recent clients Replymany packets, far larger than the request Victimis flooded with traffic it never asked for The attacker sends the same request to many servers at once, so their replies add up at the victim. Reach and damage The most detailed measurements come from “Taming the 800 Pound Gorilla”, a 2014 study. Researchers at the University of Michigan, Merit Network, Colorado State University and the University of Illinois wrote it. It combines traffic data from the security firm Arbor Networks with weekly scans of the internet and data from two regional networks. Arbor\u0026rsquo;s data covers a third to a half of all internet traffic.\nIn November 2013, NTP made up about 0.001 % of the traffic in Arbor\u0026rsquo;s data. By mid-February 2014 it had reached about 1 %, more than DNS, and it peaked on February 11. In February and March, most attacks of more than 2 Gbps (gigabits per second) used NTP. Three months earlier, only 0.07 % of all attacks had involved it.\nThe Open NTP Project began to scan the whole internet every week on January 10, 2014. Its first scan found 1,405,186 servers that answered monlist requests. Over 15 weeks, the scans saw 2,166,097 different addresses. One reason: 13–35 % of the servers were end-user computers, such as home PCs, whose addresses can change.\nNTP servers that answered monlist requests January 10, 20141,405,186 January 24, 2014677,112 February 14, 2014235,370 March 21, 2014110,565 April 18, 2014106,445 Selected weekly scans of the whole internet by the Open NTP Project. Source: Taming the 800 Pound Gorilla (2014).\nThe monlist lists also record the forged sender addresses, that is, the victims. In 15 weeks, the researchers found 437,000 attacked addresses in 184 countries, hit with 2.92 trillion packets, about 1.2 petabytes of data. Because a list typically covered only the last two days before a scan, they estimate the real numbers at about 3.8 times higher. About half of the victims were end-user computers. Many attacks targeted the network ports, a kind of numbered door, that online games use. The authors conclude that a large share of the attacks was aimed at gamers.\nOn February 10, 2014, an attack on a target in Cloudflare\u0026rsquo;s network set a record for NTP at the time. Cloudflare protects websites against such attacks. It reported that the attack peaked just under 400 Gbps and came from 4,529 NTP servers in 1,298 networks.\nNo total of the damage exists. The sources document no outages of critical services such as hospitals or power supply. Networks that carried the floods paid too. At Merit, a regional network in Michigan, the attacks added more than 2 % to its total traffic. This raised the fees Merit paid for its own internet connection.\nThe fix and the response The NTP developers had removed monlist from ntpd long before, in development version 4.2.7p26 of April 24, 2010. They replaced it with a newer command, mrulist. But the stable series, version 4.2.6, kept monlist. The first stable version without it, ntp 4.2.8, appeared only on December 19, 2014. On December 30, 2013, a request on a public security mailing list pointed to “a recent rash of DDoS involving the monlist functionality”. The flaw received the number CVE-2013-5211 the same day.\nIn January 2014, CERT/CC at Carnegie Mellon University published a vulnerability note, and US-CERT an alert. Their advice: update ntpd, or switch off the queries with one setting in the configuration file. ICS-CERT, the US team for industrial control systems, warned as well.\nThe vulnerable servers disappeared quickly. Two weeks after the first scan, fewer than half were left. By March 21, about 110,000 remained. After that, the number hardly moved: on April 18, it stood at 106,445, 92 % fewer than in January. The study praises the “community response”. The Open NTP Project published its counts every week. Researchers notified operators through CERTs (computer emergency response teams) and directly. Many networks also felt the attacks in their own traffic. The authors consider it likely that the notifications helped, but say that cause and effect cannot be proven.\nDecline in vulnerable NTP servers by continent North America97 % Oceania93 % Europe89 % Asia84 % Africa77 % South America63 % Decline in the number of servers that answered monlist requests, from January to April 18, 2014. Source: Taming the 800 Pound Gorilla (2014).\nThe cleanup was far faster than for open DNS resolvers. These servers look up addresses for anyone and can be abused in the same way. But the cleanup was not complete. About 4 million NTP servers still answered another query, version. This query can also be abused, though rarely with such large replies. That group shrank by only 19 %.\nThe National Vulnerability Database rates the flaw 5.0 out of 10 on the older CVSS version 2, “medium”. It gives no score on version 3. The score is not higher because an attacker can neither read nor change data on the server. The flaw only affects availability, mostly that of others.","title":"NTP monlist: how time servers amplified DDoS attacks","url":"https://crackthe.net/security/vulnerabilities/ntp-monlist/"}