Comments on: When firmware attacks! (DDoS by D-Link)

By: Richard Clayton

Richard Clayton — Wed, 13 Jun 2007 07:40:26 +0000

Some time ago, when I last looked at the firmware, almost all the stratum 1 time servers were still present My recommendation is to set a local NTP server (usually at your ISP) in by hand… if it doesn’t respond then you should be looking at firewall policies.

By: Pasi

Pasi — Wed, 13 Jun 2007 06:16:30 +0000

When I change the time mode to manual in my dlink 614+ it still tries to contact ntp in 30 seconds interwall. Logfile is filled with “get Time fail” and “NTP: timeout, no receive any data”. And yes, I have updated the firmware to the latest with revision info “Fixes an issue with NTP server” but it still keeps trying that NTP.

Is this firmware update just a removal of Kamps NTP-server from the NTP list or what?

By: David Klaus

David Klaus — Sun, 07 Jan 2007 05:04:17 +0000

Just a heads up. I purchased a new piece of DLink hardware and they now show the following NTP servers in a setup list:

ntp1.dlink.com
ntp.dlink.com.tw

I checked and both seem to be working.

By: They do the same to DynDns

They do the same to DynDns — Wed, 13 Dec 2006 02:52:25 +0000

Many DLink routers also display the same lack of respect for the DynDns service (Dynamic IP’s).

DynDns was forced some years ago to block all traffic from DLink routers because they would not obey the procedures laid out for updating one’s dynamic host name. (One update only ever 28 days or so, and ONLY if your IP address has changed). DLink also do not provide a valid ID string when sending the requests.

On the subject of my DI-604’s NTP setting: sure, I can change it, along with the other fields on the form, but after submitting the changes, I see no evidence that the information was kept. The form reloads with the same default information, leading me to wonder if the DI 604 is even using the configuration I entered.

DI 604 rev A, B & C last firmware was 2.20. I feel there is almost no chance there will ever be another official update patch. Indeed, I found this page by looking for a hacked firmware update.

By: Criggie

Criggie — Thu, 15 Jun 2006 20:47:18 +0000

I routinely set NTP update intervals to 1440 or a few minutes less. The recommended update time of 300 minutes seems too short… and if my clocks drift by some seconds then no great loss.

I also run a local timeserver just for work’s network.

What would make life much more useful would be if DHCP could carry information on all settings… ideally http_proxy as well as time_server and so on.

By: Light Blue Touchpaper » The Rising Tide: DDoS by Defective Designs and Defaults

Wed, 07 Jun 2006 21:32:17 +0000

[...] Dedicated readers will recall my article about how I tracked down the “DDoS” attack on stratum 1 time servers by various D-Link devices. I’ve now had a paper accepted at the 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI’06) which runs in California in early July. [...]

By: Al Bounds

Al Bounds — Mon, 08 May 2006 13:48:05 +0000

D-Link’s attitude in this matter is very simmilar to how they treated me when my D-Link WAP died for a third time while under warranty. Glad it was mine and not one of my customers! I made the descision to stay away from D-Link a few months ago and this story supports that descision. Bad product, bad company, bad attitude.

By: Tony Gore

Tony Gore — Sun, 07 May 2006 11:22:32 +0000

The ISPs could be more helpful and give their NTP server details prominently to their customers. Sometimes they require a lot of searching for.

The Belkin router I have only has a list of IP addresses to choose for NTP; the default for Europe is 129.132.2.21 which resolves to swisstime.ee.ethz.ch and the secondary default is 130.149.17.8 which is ntps1-1.cs.tu-berlin.de. There is no way to actually change these, as they are a drop down list. It does seem that unless these people have agreed to “host” NTP for Belkin, then Belkin are guilty of abuse - just as any SMTP server originally could be used for sending mail, and abuse by spammers put a stop to that.

Microsoft in http://support.microsoft.com/kb/262680/en-us gives a list of public timeservers. At no point does it mention that your ISP timeserver is better placed to do the job. If you run a Windows server system, time is important to you - clients cannot log on to the server if their time and date vary too much from the server, at least with SBS2003.

Routers may not be the only culprit - the Symantec hardware frewalls e.g. my 200R use “default timeservers” without saying which ones they are. However, you can enter your own timeserver.

There are other devices as well - my D-link DCS-900 wired camera has an NTP server - for this, you have to enter an IP address. (I had been a good boy and resolved ntp.demon.co.uk - my ISP and entered that one).

It seems to me, coming back to the ISP point, that ISPs should produce a list of things to use - both by name and by IP address. They should state that the name should be used in preference to the IP address (and equipment manufactures should be pushed to use names, not IP addresses).

After all, it is in their best interests - very NTP packet that goes out of the ISP’s network costs them more than if they handled it themselves.

By: Scott Daugherty

Scott Daugherty — Sat, 06 May 2006 15:30:18 +0000

I found this a good read for I have a D-link wireless router. I had the router for some time now but notice I could not set ntp when I bought it. Last year I set up a vpn and converted the d-link to access point duties now but I had updated the firm ware at the time. D-link states the firm ware update fixes the NTP issue. I then pointed the NTP to a local host computer. I just checked it and it is still correct. I hope D-link owns up to being responsible as indicated above. D-link should. Now that I know this I will update firm ware on other networks I know of using d-link products too.

By: Ameliorations » Stop the Presses!

Ameliorations » Stop the Presses! — Thu, 27 Apr 2006 16:21:24 +0000

[...] I have an update for anyone intereseted on the D-Link situation. Its hard to believe there are those who would question the efficiency of the threat of boycott coupled with a letter writing and blogging campaign. [...]