Incident: Massive DDoS Attack Leveraging NTP Flaw Targets CloudFlare Servers

Published Date: 2014-02-11

Postmortem Analysis
Timeline 1. The software failure incident of the massive distributed-denial-of-service attack leveraging a flaw in the Network Time Protocol (NTP) happened on Monday [Article 24598]. Estimation: Step 1: The article mentions that the incident happened on Monday. Step 2: The article was published on 2014-02-11. Step 3: The incident occurred on Monday, which would be 2014-02-10.
System 1. Network Time Protocol (NTP) - The flaw in the NTP protocol was leveraged by attackers to conduct the distributed-denial-of-service attack [Article 24598].
Responsible Organization 1. Attackers leveraging a flaw in the Network Time Protocol (NTP) were responsible for causing the software failure incident [Article 24598].
Impacted Organization 1. CloudFlare [Article 24598] 2. Customers of CloudFlare in Europe [Article 24598]
Software Causes 1. The software cause of the failure incident was a flaw in the Network Time Protocol (NTP), which attackers leveraged to conduct a massive distributed-denial-of-service attack [Article 24598].
Non-software Causes 1. The attack was a massive distributed-denial-of-service attack reaching more than 400Gbps at its peak, directed at one of the customers of CloudFlare, leveraging a flaw in the Network Time Protocol (NTP) [Article 24598]. 2. Attackers queried vulnerable NTP servers for traffic counts using the victim's spoofed address, leading to amplification of traffic directed at the victim [Article 24598]. 3. The technique's popularity has grown due to the emergence of toolkits such as DNS Flooder v1.1, allowing attackers to launch reflection attacks using their own DNS servers [Article 24598].
Impacts 1. The software failure incident, a massive distributed-denial-of-service (DDoS) attack leveraging a flaw in the Network Time Protocol (NTP), resulted in a peak traffic volume exceeding 400Gbps, surpassing the previous record set by the Spamhaus attack [Article 24598]. 2. The attack targeted servers in Europe, impacting the availability and performance of the targeted customer's services hosted on CloudFlare's network [Article 24598]. 3. The NTP reflection attack technique used in the incident caused service slowdowns across the Internet, affecting game servers hosting EA's Origin service, Blizzard's Battle.net, and League of Legends, among others [Article 24598]. 4. The attack technique's growing popularity and the use of toolkits like DNS Flooder v1.1 with amplification factors of up to 50 times the originating bandwidth have made it challenging for administrators to mitigate the vulnerability and block such attacks effectively [Article 24598].
Preventions 1. Implementing proper security measures and patches to address the flaw in the Network Time Protocol (NTP) that was leveraged by the attackers [24598]. 2. Regularly updating and securing NTP servers to prevent them from being vulnerable to exploitation by attackers [24598]. 3. Employing network monitoring and traffic analysis tools to detect and mitigate abnormal traffic patterns indicative of DDoS attacks [24598]. 4. Utilizing DDoS mitigation services provided by companies like CloudFlare to help defend against and mitigate the impact of large-scale attacks [24598].
Fixes 1. Implementing proper network security measures to prevent exploitation of vulnerabilities in the Network Time Protocol (NTP) like the one used in the DDoS attack [Article 24598]. 2. Regularly updating and patching NTP servers to address known vulnerabilities and prevent them from being used in reflection attacks [Article 24598]. 3. Employing traffic filtering and rate limiting techniques to mitigate the impact of NTP reflection attacks by reducing the volume of traffic directed at the victim [Article 24598].
References 1. CloudFlare CEO Matthew Price's tweets [Article 24598] 2. US-CERT advisory [Article 24598] 3. Security vendor Prolexic's report [Article 24598]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to a massive distributed-denial-of-service (DDoS) attack leveraging a flaw in the Network Time Protocol (NTP) happened again at Cloudflare. The attack targeted one of Cloudflare's customers in Europe, and Cloudflare CEO Matthew Price mentioned that it was bigger than the previous Spamhaus attack. This incident highlights a recurring vulnerability within Cloudflare's infrastructure [Article 24598]. (b) The software failure incident involving NTP reflection attacks has also affected other organizations. US-CERT issued an alert warning companies about the growing popularity of NTP reflection attacks after game servers hosting EA's Origin service, Blizzard's Battle.net, and League of Legends were taken down using this technique. Prolexic, a security vendor, observed the attack being used on several clients during the past six months, indicating that multiple organizations have been targeted by similar attacks [Article 24598].
Phase (Design/Operation) design (a) The software failure incident described in the article is related to the design phase. The incident was a massive distributed-denial-of-service (DDoS) attack that reached more than 400Gbps at its peak. The attack leveraged a flaw in the Network Time Protocol (NTP), a network protocol used to synchronize computer clock times. Attackers exploited this flaw in the design of the NTP protocol to amplify the volume of traffic directed at the victim by querying vulnerable NTP servers for traffic counts using the victim's spoofed address. This design vulnerability allowed the attackers to launch a significant DDoS attack on servers in Europe [24598]. (b) The software failure incident is not directly related to the operation phase or misuse of the system. The primary cause of the incident was the exploitation of a flaw in the NTP protocol during the design phase, rather than issues arising from the operation or misuse of the system.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident described in the article is primarily due to contributing factors that originate from within the system. The incident was a massive distributed-denial-of-service (DDoS) attack that reached over 400Gbps, targeting a customer of CloudFlare by leveraging a flaw in the Network Time Protocol (NTP) [Article 24598]. The attack technique involved querying vulnerable NTP servers for traffic counts using the victim's spoofed address, leading to a significant amplification of traffic directed at the victim. This attack technique exploited a vulnerability within the NTP servers, which are part of the system being targeted. (b) outside_system: The software failure incident is also influenced by contributing factors that originate from outside the system. The attackers behind the DDoS attack utilized the flaw in the NTP protocol to launch the attack, indicating that the external threat actors exploited a weakness in the system's external communication protocols to carry out the attack [Article 24598]. The attack was not a result of an internal system error or fault but rather an external manipulation of the NTP protocol to generate a massive volume of traffic directed at the victim's servers.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in the article was primarily due to non-human actions. The incident was a massive distributed-denial-of-service (DDoS) attack that reached over 400Gbps at its peak, targeting servers in Europe by leveraging a flaw in the Network Time Protocol (NTP) [Article 24598]. The attack technique involved querying vulnerable NTP servers for traffic counts using the victim's spoofed address, leading to an amplification of traffic directed at the victim. This type of attack is initiated by exploiting vulnerabilities in the NTP protocol and does not involve direct human actions in the attack process.
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The incident was a massive distributed-denial-of-service (DDoS) attack that reached more than 400Gbps at its peak [Article 24598]. - The attack leveraged a flaw in the Network Time Protocol (NTP), a network protocol used to synchronize computer clock times [Article 24598]. - Attackers queried vulnerable NTP servers for traffic counts using the victim's spoofed address, leading to amplification of traffic directed at the victim [Article 24598]. (b) The software failure incident related to software: - The attack exploited a flaw in the Network Time Protocol (NTP), indicating a software vulnerability that was leveraged by the attackers [Article 24598]. - The incident involved the use of toolkits like DNS Flooder v1.1, which utilized a unique method to launch reflection attacks, showcasing software-based attack techniques [Article 24598].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. It was a massive distributed-denial-of-service (DDoS) attack that reached more than 400Gbps at its peak, targeting one of the customers of CloudFlare by leveraging a flaw in the Network Time Protocol (NTP) [Article 24598]. The attack was directed at servers in Europe and involved attackers querying vulnerable NTP servers for traffic counts using the victim's spoofed address, resulting in amplification of traffic directed at the victim. The attack was described as a "very big NTP reflection attack" by Cloudflare CEO Matthew Price, who mentioned that someone had a "big, new cannon" and warned of "ugly things to come." The attack technique's popularity had grown in recent months, and it was difficult to block due to the responses being legitimate data coming from valid servers.
Intent (Poor/Accidental Decisions) unknown The software failure incident described in the article is related to a distributed-denial-of-service (DDoS) attack that reached more than 400Gbps at its peak. The attack was directed at one of the customers of CloudFlare, a content delivery network and security provider, and it leveraged a flaw in the Network Time Protocol (NTP) [24598]. (a) The intent of the software failure incident does not seem to be related to poor decisions. Instead, it appears to be a deliberate attack orchestrated by malicious actors to disrupt services by exploiting vulnerabilities in the NTP protocol and using reflection techniques to amplify the volume of traffic directed at the victim. (b) The software failure incident was not accidental but rather a deliberate and malicious act aimed at causing disruption and service slowdowns across the Internet. The attackers intentionally targeted servers in Europe and utilized the NTP reflection attack technique to amplify the traffic directed at the victim [24598].
Capability (Incompetence/Accidental) accidental (a) The software failure incident reported in the article is not related to development incompetence. The incident was a massive distributed-denial-of-service (DDoS) attack that reached more than 400Gbps at its peak, targeting a customer of CloudFlare by leveraging a flaw in the Network Time Protocol (NTP) [Article 24598]. (b) The software failure incident reported in the article is more aligned with an accidental failure. The attack was directed at servers in Europe using a technique where attackers query vulnerable NTP servers for traffic counts using the victim's spoofed address. This technique allows the attacker to amplify the volume of traffic directed at the victim, making it difficult to block these types of attacks [Article 24598].
Duration temporary (a) The software failure incident described in the article was temporary. It was a massive distributed-denial-of-service (DDoS) attack that reached more than 400Gbps at its peak, targeting one of the customers of CloudFlare. The attack leveraged a flaw in the Network Time Protocol (NTP) and was directed at servers in Europe. Cloudflare CEO Matthew Price mentioned in a tweet that it was a "very big NTP reflection attack hitting us right now" and that it appeared to be bigger than the previous Spamhaus attack. The attack was being mitigated, indicating that it was a temporary incident [24598].
Behaviour other (a) crash: The software failure incident described in the article is not related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The incident does not involve the system omitting to perform its intended functions at an instance(s). (c) timing: The failure is not related to the system performing its intended functions correctly but too late or too early. (d) value: The software failure incident is not due to the system performing its intended functions incorrectly. (e) byzantine: The incident does not involve the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident described in the article is related to a massive distributed-denial-of-service (DDoS) attack leveraging a flaw in the Network Time Protocol (NTP) to amplify traffic directed at the victim's servers. This behavior falls under the category of a deliberate attack exploiting a vulnerability in the system's network protocol [24598].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human (d) Property: People's material goods, money, or data was impacted due to the software failure. The software failure incident described in the article resulted in a massive distributed-denial-of-service (DDoS) attack that reached over 400Gbps, targeting servers in Europe. The attack leveraged a flaw in the Network Time Protocol (NTP) to synchronize computer clock times. This attack technique involved querying vulnerable NTP servers for traffic counts using the victim's spoofed address, leading to amplified traffic directed at the victim. As a consequence, the attack impacted the targeted customer's servers and potentially disrupted their services. Additionally, the attack on Cloudflare and key Internet switching stations in Amsterdam, Frankfurt, and London resulted in service slowdowns across the Internet, indicating a significant impact on the affected organizations and users' access to online services [24598].
Domain information (a) The software failure incident reported in Article 24598 is related to the information industry. The incident involved a massive distributed-denial-of-service (DDoS) attack directed at a customer of a content delivery network and security provider, CloudFlare. The attack leveraged a flaw in the Network Time Protocol (NTP), a network protocol used to synchronize computer clock times. The attack targeted servers in Europe and utilized NTP reflection attacks to amplify the volume of traffic directed at the victim [24598].

Sources

Back to List