Stories
Slash Boxes
Comments

SoylentNews is people

New Attacks on Network Time Protocol can Defeat HTTPS and Create Chaos

posted by martyb on Thursday October 22 2015, @10:44PM   Printer-friendly
from the does-anyone-really-know-what-time-it-is? dept.

darkfeline writes:

http://arstechnica.com/security/2015/10/new-attacks-on-network-time-protocol-can-defeat-https-and-create-chaos/

Ars Technica reports on a vulnerability where unencrypted Network Time Protocol (NTP) traffic can be exploited by man-in-the-middle attacks to arbitrarily set the times of computers to cause general chaos and/or carry out other attacks, such as exploiting expired HTTPS certificates.

While NTP clients have features to prevent drastic time changes, such as setting the date to ten years in the past, the paper on the attacks presents various methods for bypassing these protections.

There is a pdf of the report available.

Original Submission

 
This discussion has been archived. No new comments can be posted.
New Attacks on Network Time Protocol can Defeat HTTPS and Create Chaos | Log In/Create an Account | Top | 19 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 3, Informative) by chrysosphinx on Friday October 23 2015, @12:45AM

    by chrysosphinx (5262) on Friday October 23 2015, @12:45AM (#253462)

    Both methods you suggest are still exploitable. The first one is just heuristic expecting mim attacks are nonlocal, the second one is even worse since it can prevent recovery from attacks.

    Starting Score:    1  point
    Moderation   +2  
       Informative=2, Total=2
    Extra 'Informative' Modifier   0  
    Total Score:   3  

  • (Score: 2) by frojack on Friday October 23 2015, @02:31AM

    by frojack (1554) on Friday October 23 2015, @02:31AM (#253490) Journal

    The first one is just heuristic expecting mim attacks are nonlocal,

    This method is actually built into most ntp clients.
    The client will arbitrarily toss out the Outliers and select the most reliable of the rest.

    --
    No, you are mistaken. I've always had this sig.

    • (Score: 2, Interesting) by xav on Friday October 23 2015, @01:06PM

      by xav (5579) on Friday October 23 2015, @01:06PM (#253580)

      I'm under the impression you didn't understand chrysosphinx's answer, pardon me if I'm wrong.
      With a local MitM attack, all responses from all NTP servers can be manipulated, and they will all appear to be in agreement.