Linked by Thom Holwerda on Sun 9th Apr 2006 12:49 UTC, submitted by rycamor
Legal FreeBSD developer Poul-Henning Kamp (PHK) happens to run a tier-1 NTP server, intended only for use by ISPs' main servers in Denmark, and specifically not intended for individual client connections, not to mention client connections from anywhere else in the world. He offers this service pro bono to ISPs. Unfortunately, D-Link has decided to abuse the open nature of the NTP protocol and has actually hard-coded PHK's server hostname in the firmware of several of their home network products. Since contacting D-Link yielded no results, PHK went public.
Permalink for comment 113135
To read all comments associated with this story, please click here.
change the domain name
by kamper on Sun 9th Apr 2006 18:00 UTC
Member since:

Seems to me that what he has to do is change the domain name. Yes, he pointed out that this would be very time consuming, but it can't be any worse than shutting down the server all the way (which it seems he will have to do if he doesn't get money from D-Link).

That won't provide him with real security, but it will undo the years of harm that D-Link has built up and give the ntp community as a whole time to mount a proper suit against the scum. It seems that there are enough people being affected by this stupidity that they'd have at least a bit of clout.

For the long run, though, I think that designing slightly more DoS-proof systems would be a better idea.

And seeing the recurring trend with the netgear thing, I wonder what percentage of soho routers from other companies actually do this sort of thing. They discovered that D-Link is causing trouble, but I didn't see proof that all the traffic was from D-Link devices. I'd like to get my linksyses behind a real router (read: OpenBSD on a soekris) and see what kind of crap they're spewing.

Reply Score: 1