Q:

DDOS using ntp server

I've heard about new kind of DDOS where ntp is used for reflection .
My questions are really simple :

Can you please give details on how they work and clarify? Since ntp is ran over UDP, I suppose there must be some kind of forged packet somewhere?
How is it possible to exhaustively check if some ntp server are vulnerable (and can't be involved in any attack)?
If ever we become the target of such attack, is there any way to mitigate?

As this kind of attack has been widely used in 2014, here are a few more details :

You can find more information ont this cve.
"Yesterday evening 01/30/2014, starting at 22:15 CET, Witbe network in Paris has been seriously affected by a Distributed Denial of Service (DDOS) attack using NTP amplification."
Ouch, 350Gpbs, that hurts http://www.itnews.com.au/News/372033,worlds-largest-ddos-strikes-us-europe.aspx
Generic behaviour about ddos can be found here : I am under DDoS. What can I do?
Bbc talks about ntp attacks : http://www.bbc.com/news/technology-26662051
One more question : If I record correctly, openntpd listens by default on 127.0.0.1 and ntpd listens on 0.0.0.0 - I'm not really sure if all ntp servers involved in reflection ddos needed to serve time publically - Merely, I think some unskilled sysadmins installed ntp to synchronize time locally and left default configuration files. 

A simple way to prevent and mitigate this kind of problem would be to listen on 127.0.0.1 by default? I guess this is true for any service (bind9, mysql, ...)?

A:

These attacks have been around for ages, they just became popular again the last couple of months. They work like any regular amplification attack: a host spoofs a query so that the source IP address seems to be the targetted host. The NTP server sends its answer to the spoofed address. Since the answer for specific query types can be quite large and usually is UDP, this can quite rapidly become a problem for the targetted host: it's being swamped with NTP packets. 
Unfortunately this isn't a vulnerability in NTP servers, it's just a feature which is being abused. One thing to consider is if you need to run NTP servers which can be queried from the entire internet. If that's not needed, create an access list or firewall policy to block queries coming from untrusted sources. Then, what you can do to check if your NTP servers are vulnerable is doing NTP queries from untrusted sources and verify if you get an answer. But unfortunately there are quite a number of NTP servers which are public by intent (e.g. all servers in pool.ntp.org). If you need to run a public NTP server, you can consider implementing query ratelimiting to reduce impact to the targetted host in case of abuse.
Another, more generic part of the solution is that networks need to implement BCP38, which tells them to filter traffic leaving their networks so sending spoofed packets is impossible. Unfortunately, there are still a large number of networks which do not implement this kind of filtering, so all attacks with spoofed source packets (using any protocol like NTP, DNS or chargen) are still possible.
What you can do to mitigate such an attack depends a bit on your network and tools available, but one thing you should consider is blocking incoming NTP packets from untrusted sources (so check which NTP servers you're using). Of course, this doesn't help if your uplink is congested. In that case, you'll need to ask your ISP to help you filter the traffic.

