Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: NTP DDoS Counts Have Dropped SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
NTP DDoS Counts Have Dropped

I was poking around the usual online rags and found a piece on Threat Post. [1]  Mike Mimoso was highlighting the decline of the NTP DDoS hole found earlier in the year.  The ISC covered it in our diary a few months back.  

NTP Reflection Attack 
Ongoing NTP Amplification Attacks
NTP Reflection Attacks Continue

So, I went poking through the port data and noticed a good correlation to the Threat Post story.  The numbers indicate a sharp decrease in vulnerable systems for the NTP monlist issue.   I'd like to suggest that while pundits are citing slow progress for patching Heartbleed, that in actuality, the Heartbleed issue is responsible for the sudden change.  The month of May showed an extensive effort for patching and truing up patch levels because of Heartbleed.  This effort likely assisted in the NTP issue being patched along with it.  The following graph was taken from ISC data gathered here:

Feel free to share your thoughts on this one.


Kevin Shortt

85 Posts
ISC Handler
Jun 24th 2014

Sign Up for Free or Log In to start participating in the conversation!