NTP amplification is a sort of DDoS assault in which the attacker uses publicly accessible Network Time Protocol (NTP) servers to flood UDP traffic to the target.
NTP amplification attacks were relatively uncommon until 2013 when a significant uptick occurred. In December and January, NTP amplification affected many popular online gaming sites, including EA.com, Battle.net, and League of Legends, with garbage traffic rates reaching 100 Gbit/s.
The query-to-response ratio of an NTP amplification attack can range from 20:1 or 200:1 or higher. The value of the query-response depicts that an attacker who receives some available NTP servers can quickly launch a high-bandwidth and high-volume cyberattack.
Hackers mainly use DDoS attacks against a variety of large and medium-sized organizations. While usually only threatening websites, NTP attacks often use DDoS attacks to extort and inflict direct harm to businesses and mask any penetration attempts. Therefore, a DDoS attack is always a significant problem that’s exceedingly difficult to resolve, irrespective of the hackers’ goals.