NTP DDoS攻撃

Understanding and mitigating NTP-based DDoS attacks | CloudFlare Blog

NTP contains a command called monlist (or sometimes MON_GETLIST) which can be sent to an NTP server for monitoring purposes. It returns the addresses of up to the last 600 machines that the NTP server has interacted with. This response is much bigger than the request sent making it ideal for an amplification attack.

monlistコマンドでデータが大きくなって帰ってくるのでDDoS攻撃できちゃうという話らしい。

まあ、NTPサーバを外部に公開していなければ問題なさそうだし、ntp.confでnoqueryを設定しておけば、monlistに反応しないので大丈夫なはず。NTPDをアップデートすればより安心だが。