Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.

New Attacks on Network Time Protocol can Defeat HTTPS and Create Chaos

posted by martyb on Thursday October 22 2015, @10:44PM   Printer-friendly
from the does-anyone-really-know-what-time-it-is? dept.

darkfeline writes:

http://arstechnica.com/security/2015/10/new-attacks-on-network-time-protocol-can-defeat-https-and-create-chaos/

Ars Technica reports on a vulnerability where unencrypted Network Time Protocol (NTP) traffic can be exploited by man-in-the-middle attacks to arbitrarily set the times of computers to cause general chaos and/or carry out other attacks, such as exploiting expired HTTPS certificates.

While NTP clients have features to prevent drastic time changes, such as setting the date to ten years in the past, the paper on the attacks presents various methods for bypassing these protections.

There is a pdf of the report available.

Original Submission

 
This discussion has been archived. No new comments can be posted.
New Attacks on Network Time Protocol can Defeat HTTPS and Create Chaos | Log In/Create an Account | Top | 19 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 5, Interesting) by PhilSalkie on Friday October 23 2015, @02:47AM

    by PhilSalkie (3571) on Friday October 23 2015, @02:47AM (#253491)

    Fortunately, some quite reliable folks have been working on issues like this for a while now:

    http://www.ntpsec.org/ [ntpsec.org]

    Eric said recently that they're about two weeks from a beta release - if these issues aren't already addressed, I'm sure they will be soon.

    Personally, my desktop connects to a stratum 0 time source - NMEA GPS receiver, RS-232 interface board with PPS (which I designed - want one?), and GPSD.
    Typically I see jitter values below 10 microseconds, and don't have to worry about somebody changing my clock over the interwebs.

    Starting Score:    1  point
    Moderation   +4  
       Interesting=3, Underrated=1, Total=4
    Extra 'Interesting' Modifier   0  
    Total Score:   5  

  • (Score: 2) by Lagg on Friday October 23 2015, @01:33PM

    by Lagg (105) on Friday October 23 2015, @01:33PM (#253587) Homepage Journal

    I'd totally ask you for prices if I hadn't gotten rid of my last serial port boards. Have been interested in self-sufficient time sources for a while now

    --
    http://lagg.me [lagg.me] 🗿