Re: sober resurfacing

Sober's previous variants access NTP on port 37, so blocking port 123
(NTP) won't do anything. As long as the new variant follows the same
pattern, block port 37 and SMTP from anything other than mail servers
and you shold minimize the impact.

If your internal clients aren't using an internal time source, they
should be. Set up a few BSD boxes or routers with NTP services and
allow those and those only to sync time with an external source. Then
even IF the variant uses port 123, it still won't be able to get out
and check the time with its predefined server list because you would
have locked down port 123 outbound to only 2 or so hosts.

-J

On 12/15/05, Curt Shaffer <cshaffer@xxxxxxxxx> wrote:
> All,
>
> I am working on a plan to try and help minimize the effect of the possible
> sober resurfacing on Jan. 5/6th. After reading the security focus article
> that this worm relies on NTP to know when to release, I am wondering on the
> feasibility of blocking NTP out to the internet that week except for the
> certain devices that need it. Does anyone have input on this?
>
> Thanks
>
> Curt
>
>
>
>
>
>
>
> ---------------------------------------------------------------------------
> ---------------------------------------------------------------------------
>
>

---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • Re: xntp both serve and client
    ... we only use NTP as a client. ... ntpd binds UDP port 123 on all interfaces. ... The port scan shows that ntpd is listening on 123/UDP. ... If you tell ntpd to poll certain servers that is what it will do. ...
    (comp.protocols.time.ntp)
  • Re: NTP time service not syncing
    ... The newest version of NTP. ... The time server is listening on UDP port 123. ... the simple network time protocol Version-4. ...
    (microsoft.public.windows.server.general)
  • ntpd problems after port updates
    ... I am running NTPD built from ports on system that has had world rebuilt without ntp. ... After doing some port updates this morning to the latest OpenSSL which caused ntp to rebuild as its built against the OpenSSL port. ...
    (freebsd-questions)
  • Re: [SLE] ntp failure
    ... Your NTP packets are getting out, but no replies are coming in. ... not checked this server in the list of public access servers maintained ... It is important to note that by default, the ntp protocol uses UDP port ... reference clocks. ...
    (SuSE)
  • Re: NTP with 2 Routers
    ... The NTP requests go out port 123 via the WAN port, ... Since the WAN port is not connected to anything in your ...
    (alt.internet.wireless)