SoylentNews

New Attacks on Network Time Protocol can Defeat HTTPS and Create Chaos

posted by martyb on Thursday October 22 2015, @10:44PM   
from the does-anyone-really-know-what-time-it-is? dept.

darkfeline writes:

http://arstechnica.com/security/2015/10/new-attacks-on-network-time-protocol-can-defeat-https-and-create-chaos/

Ars Technica reports on a vulnerability where unencrypted Network Time Protocol (NTP) traffic can be exploited by man-in-the-middle attacks to arbitrarily set the times of computers to cause general chaos and/or carry out other attacks, such as exploiting expired HTTPS certificates.

While NTP clients have features to prevent drastic time changes, such as setting the date to ten years in the past, the paper on the attacks presents various methods for bypassing these protections.

There is a pdf of the report available.

---

Original Submission

• Ten years? (Score: 3, Informative) by frojack on Friday October 23 2015, @02:12AM

  by frojack (1554) on Friday October 23 2015, @02:12AM (#253486) Journal

  While NTP clients have features to prevent drastic time changes, such as setting the date to ten years in the past,

  Try 16 minutes. Even a few hours off is enough for most NTP clients to intentionally not sync.

  Quoting the ntp site: [ntp.org]

  -g
  Normally, ntpd exits if the offset exceeds the sanity limit, which is 1000 s by default. If the sanity limit is set to zero, no sanity checking is performed and any offset is acceptable. This option overrides the limit and allows the time to be set to any value without restriction; however, this can happen only once. After that, ntpd will exit if the limit is exceeded. This option can be used with the -q option.

  --
  No, you are mistaken. I've always had this sig.

  Starting Score:	1		point
  Moderation		+1
  Informative=1, Total=1
  Extra 'Informative' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3