Tag: gps

NTP Spoof Attacks

Null

Apparently 2 out of 3 of our GPS clocks were being used in a spoof/DDOS attack.

The basic premise is that time requests are sent to the service with a spoofed IP for the response. Add in 100/1000/10000 clocks send results to a server/service that did not request them results in a denial of service attack.

Both clocks have been removed from the pool, scheduled for February 6th. Hickory.kulish.com has port 123 UDP closed at this time. The maintainer of Dickory.kulish.com has been notified.

At the height of the attack, from our perspective, we pushed 24GB (Byte not Bit) of NTP traffic in 24 hours (not much by all accounts, but enough to help with the damage the asshat was trying to cause).

One clock was misconfigured, noquery had been commented out (likely for initial testing). This has been fixed.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211

https://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks/

Recent ntp version apparently do NOT respond to “monlist” packets.  You can still get a monlist by issuing:

ntpq -c “mrulist” 127.0.0.1

Hits: 0

Pi GPPS Clocks

Null2 Comments

Use Chris’ PPS kernel (until I have time or am compelled to compile my own).

Compile ntp 4.2.6p5 as follows (from aquarat):
But first: apt-get install libcap-dev

./configure --enable-ATOM --enable-NMEA --enable-linuxcaps; make; make install

Disable TTY on /dev/AMA0 in /boot/cmdline.txt
dwc_otg.lpm_enable=0 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 elevator=deadline rootwait

Set baud rate in /boot/config.txt
init_uart_baud=9600

and
Disable GPU sdram pause
# Disable GPU sdram mem pause
disable_pvt=1

Comment out getty in /etc/inittab:

#Spawn a getty on Raspberry Pi serial line
#T0:23:respawn:/sbin/getty -L ttyAMA0 115200 vt100

Add pps-gpio to /etc/modules

Disable all but $GPRMC sentences (in rc.local in my case since I have no battery):

/bin/echo -e '$PMTK314,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0*29\r\n' > /dev/ttyAMA0
/etc/init.d/ntp restart

vi /etc/udev/rules.d/09.pps.rules

KERNEL=="ttyAMA0", SYMLINK+="gps0"
KERNEL=="pps0", OWNER="root", GROUP="tty", MODE="0777", SYMLINK+="gpspps0"

Be sure to restart ntp after reducing sentence output. Mine started drifting negative when I didn’t restart.

Here is my ntp.conf.
Some will argue about whether using stratum 1 sanity servers is necessary, noselect, on and on, yada yada.
This works for me and gets me pretty good stability.

I think the numbers speak for themselves. Bear in mind that I will have 2 different GPS clocks in the near future so I am less inclined to sync to an outside source. I keep some of the better known S1 clocks in there purely for my peace of mind. I’m part of the ntppool so I do not use them to sync in the event of a GPS failure. Again, opinions vary.

GPS1:
remote refid st t when poll reach delay offset jitter
==============================================================================
+tick.usno.navy. .IRIG. 1 u 28 64 377 63.014 -0.940 6.541
+ntp.okstate.edu .USNO. 1 u 23 64 377 49.207 -0.392 0.185
-navobs1.wustl.e .GPS. 1 u 14 64 377 49.768 -3.915 0.237
-tick.uh.edu .GPS. 1 u 16 64 377 56.676 5.286 0.388
oGPS_NMEA(0) .GPS1. 0 l 5 8 377 0.000 0.017 0.003
+hcpi002.lan.sid .GPS2. 1 u 8 64 377 0.850 0.157 0.126

GPS2:
remote refid st t when poll reach delay offset jitter
==============================================================================
+tick.usno.navy. .IRIG. 1 u 13 64 377 63.536 -0.624 0.249
+ntp.okstate.edu .USNO. 1 u 16 64 377 49.068 -0.524 0.161
-navobs1.wustl.e .GPS. 1 u 15 64 377 50.469 -4.109 0.163
-tick.uh.edu .GPS. 1 u 5 64 377 56.892 4.870 0.387
oGPS_NMEA(0) .GPS2. 0 l 2 8 377 0.000 -0.100 0.008
+hcpi001.lan.sid .GPS1. 1 u 13 64 377 0.809 -0.358 0.168

Note that the GPSes are still slewing since ntpd was recently restarted.

GPS1 ntp.conf:
driftfile /var/log/ntpstats/ntp.drift
statsdir /var/log/ntpstats/

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

# Sanity Servers
server tick.usno.navy.mil iburst
server ntp.okstate.edu iburst
server navobs1.wustl.edu iburst
server tick.uh.edu iburst

restrict default nomodify noquery
restrict 127.0.0.1
restrict 10.1.1.0 mask 255.255.255.0 nomodify

server 127.127.20.0 mode 17 minpoll 3 prefer #use $GPRMC only!
fudge 127.127.20.0 flag1 1 time2 0.350 refid GPS1

peer gps2.lan.side

GPS2 ntp.conf:
driftfile /var/log/ntpstats/ntp.drift
statsdir /var/log/ntpstats/

statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

# Sanity Servers
server tick.usno.navy.mil iburst
server ntp.okstate.edu iburst
server navobs1.wustl.edu iburst
server tick.uh.edu iburst

restrict default nomodify noquery
restrict 127.0.0.1
restrict 10.1.1.0 mask 255.255.255.0 nomodify

server 127.127.20.0 mode 17 minpoll 3 prefer #use $GPRMC only!
fudge 127.127.20.0 flag1 1 time2 0.350 refid GPS2

peer gps1.lan.side

Hits: 0

Google Maps and your Garmin on Ubuntu and Windows

Null1 Comment

Or, “Where the hell are we?!” Part 2:

I recently bought a Nuvi 255W for some business travel coming up. I didn’t want to install Map Source since I don’t plan on buying any map packs any time soon. What I found was Garmin Communicator.

Windows:
Straight forward download and install.

Linux (Ubuntu):
apt-get install wine-gecko
Download Garmin Communicator
Download Firefox for Windows
Use wine to install Firefox and the Communicator plugin

Adding Waypoints:
To add waypoints using Google Maps, run the Windows version of Firefox.
Navigate to Google Maps and search for the location you want to add a waypoint for.
Click the “send” link, you should have a GPS selection now.
Select your GPS Manufacturer, in this case “Garmin”. This will send you to my.garmin.com.
At my.garmin.com, select which GPS you want to add the waypoint to.
Click the “Send to GPS” button.

All done.

Hits: 0

Maintenance: gps.kulish.com

Null1 Comment

The gps.kulish.com FQDN will be re-directed to our backup stratum 2 server during a short maintenance window from 1700 – 2000 CDT US.

ntp pool clients should see no interruption in services. However, this means that kulish.com will be providing a stratum 2 time source while the gps is offline. **

Stratum 1 services are expected to resume at, or before, 2000 CST.

During maintenance we will be making final adjustments to the GPS system before going “live”.

** A second stratum 1 server will be coming online Q2 2008 to avoid the stratum bump in the future.

NOTE: See comments for details about the outage.

Hits: 2

NTP: ntpq output explained

Null3 Comments

Host1:~# ntpq -p
remote refid st t when poll reach delay offset jitter
==========================================================
-navobs1.oar.net .USNO. 1 u 958 1024 377 89.425 -6.073 0.695
*navobs1.gatech. .GPS. 1 u 183 1024 375 82.102 1.639 0.281
-NAVOBS1.MIT.EDU .PSC. 1 u 895 1024 377 90.912 -0.207 0.368
+navobs1.wustl.e .GPS. 1 u 48 1024 377 76.890 1.093 0.525
-bigben.cac.wash .USNO. 1 u 924 1024 377 113.327 0.028 0.326
+tick.ucla.edu .GPS. 1 u 107 1024 377 102.470 2.032 0.482
-ntp.alaska.edu .GPS. 1 u 881 1024 377 168.741 5.180 5.157
-tock.mhpcc.hpc. .GPS. 1 u 933 1024 377 174.518 -1.094 0.054

Host2# ntpq -p
remote refid st t when poll reach delay offset disp
==========================================================
+128.252.19.1 .GPS. 1 u 495 1024 377 30.90 -6.366 8.26
*139.78.133.139 .USNO. 1 u 936 1024 377 48.43 -2.906 5.20

Columns Defined:
remote: peers speficified in the ntp.conf file
* = current time source
# = source selected, distance exceeds maximum value
o = source selected, Pulse Per Second (PPS) used
+ = source selected, included in final set
x = source false ticker
. = source selected from end of candidate list
– = source discarded by cluster algorithm
blank = source discarded high stratum, failed sanity

refid: remote source’s synchronization source

stratum: stratum level of the source

t: types available
l = local (such as a GPS, WWVB)
u = unicast (most common)
m = multicast
b = broadcast
– = netaddr

when: number of seconds passed since last response

poll: polling interval, in seconds, for source

reach: indicates success/failure to reach source, 377 all attempts successful

delay: indicates the roundtrip time, in milliseconds, to receive a reply

offset: indicates the time difference, in milliseconds, between the client server and source

disp/jitter: indicates the difference, in milliseconds, between two samples

Quick Update:
Here is a more in-depth reference:

Real Life NTP

Hits: 22