Kerberos: How could an attacker exploit insider access to invalidate tickets for a service?

Question

Assume: the attacker has legitimate insider access to a Kerberos system.

Background: The attacker is looking to invalidate all tickets for a service (maybe he really dislikes a service). To do so, he wants to exploit his access to the system in order to mess with the NTP protocol.

Question: How could the user invalidate all of the tickets for the service he does not like?

As the ticket granting server is doing the polling to establish the correct time via the NTP protocol, I don't see how a malicious attacker could invalidate the tickets for a specific service by messing with the timing. Is this possible?

Answer 1

A brief answer here, the linked articles go into much more detail.

A local network attacker could MITM a connection using e.g. using Delorean toolkit. This could then cause a server to set their clock into the past.

When calculating expiry dates for issued certificates and tickets, services will then use an algorithm along the lines of expiry = time + timeout, however if time is the attacker's set time, the expiry date will be in the past and the item will have already expired, meaning it cannot then be used for authentication.

An attacker has successfully denied service to users by causing all authentication services to have issued expired tokens. More details here.