[mat-wg] Prevention of NTP reflection attacks using TTM systems

Dear colleagues,

During the evening of Wednesday 8 January, the RIPE NCC received initial
reports about the abuse of some of our Test Traffic Measurement (TTM)
systems, specifically about the use of NTP in reflection attacks.

Within 24 hours of receiving the first report, we adapted the NTP
configuration on all our TTM hosts so that this specific type of attack
is no longer possible using the TTM infrastructure.

We would like to thank Gert Doering (SpaceNet) and Michael Hausding
(SWITCH-CERT) for reporting the abuse to us. We’d also like to share
this resource about securing NTP servers that you may find useful:

  http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html

We are taking this opportunity to remind you that we are nearing end of
service for TTM. As we announced previously, TTM shutdown is scheduled
for the end of Q1, 2014. RIPE Atlas, and specifically RIPE Atlas
anchors, will provide much of the functionality of TTM. More details,
including information about hosting a RIPE Atlas anchor, are available at:

  https://atlas.ripe.net/about/anchors/

Kind regards,

Romeo Zwart
RIPE NCC