Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ntp]

Network Time Protocol, or NTP, is a protocol for synchronizing time across a network.

0
votes
1answer
63 views

Are NTP servers without monlist still dangerous?

I've been studying DOS flood attacks, namely NTP and DNS floods. I know that monlist is the primary factor in launching these sorts of attacks, but I have one question. The problem is are these ...
61
votes
9answers
10k views

How important is local time for security?

I recently wanted to see what happens when I change my local time to something obviously wrong. I tried the year 2218, so 200 years in the future. The result: I couldn't access any website anymore (I ...
1
vote
2answers
144 views

packets characteristics (src,dst ports) of a DDos amplification attacks

In a DDoS amplification attack, say NTP flooding, an attacker uses a botnet network in order to query multiple NTP servers on port 123, spoofing the source address using the address of the victim/...
1
vote
0answers
33 views

Accessing SNTP MD5 Authorized Time Sync Server through GPO

I am running a Windows Server 2008 R2 server network connected to a Hardware Time Sync Server with MD5 authentication enabled. All the servers and clients are configured through NTP as NTP clients to ...
1
vote
0answers
91 views

Is there a legitimate reason why 100K+ of data would be sent/received in NTP requests?

I'm looking at some network activity and noticing a lot of supposed NTP traffic sending payloads of 100K+ bytes of data and receiving the same amount right back. Representative sample of a larger ...
5
votes
1answer
462 views

Overall Security of Network Time Protocol

I am doing some research in order to get an understanding of the security of the Network Time Protocol. In particular, my goal was/is to understand how the protocol is secured and what the issues are. ...
9
votes
1answer
7k views

What was/is the purpose of the 'MONLIST' command in NTP?

Having looked through multiple RFC documents about NTP without success (of finding an answer), and a ton of blog posts stating how dangerous, evil and useless this command is, but do not explain why ...
2
votes
0answers
162 views

Does NTP compromise anonymity?

I read today for the first time about the NTP protocol, and realized I have a NTP daemon running on my system, with a socket syncing to some (assumed randomly selected) server. Does this at all have ...
2
votes
1answer
2k views

Nmap NTP scanning monlist

I'm trying to find if an NTP server allows or disallows usage of the "monlist" command with Nmap, but I haven't found how to do that. I found the following script : https://nmap.org/nsedoc/scripts/...
4
votes
3answers
2k views

Industry-accepted time sources

PCI DSS requirement 10.4.3 asks to: Examine systems configurations to verify that the time server(s) accept time updates from specific, industry-accepted external sources (to prevent a malicious ...
0
votes
1answer
113 views

What does “if ntp is configured to allow remote configuration” mean in this ntp CVE?

I'm reviewing CVE-2015-7850 and it says: • Affects: All ntp-4 releases up to, but not including 4.2.8p4, and 4.3.0 up to, but not including 4.3.77 • Summary: If ntpd is configured to allow ...
6
votes
1answer
570 views

What's happening on my wifi? NTP and ACK STORM attacks.

I'm wondering if these attacks are something to worry about, or just my router being a router. [DoS attack: ACK Scan] attack packets in last 20 sec from ip [60.221.254.230], Friday, May 06,2016 21:12:...
4
votes
1answer
253 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
5
votes
2answers
603 views

Can CVE-2015-7704 - ntpd kiss-of-death affect NTP time servers or just clients?

As the ntp.conf file on a linux server can be setup to allow the system to act as both a client to the public servers and a time server source for local systems am I correct in assuming that it (the "...
4
votes
1answer
1k views

Man in the Middle Attack against NTP

So, lately I've been really into penetration testing and learning the nitty-gritty of tech. I'm dong courses on computer architecture, cryptography, surveillance law, and computer networks. I never ...
3
votes
1answer
1k views

How it is dangerous that the ntp service listen to all IPs on Linux?

When I run the following command I get that the following output: netstat -atpun | grep ntp udp 0 0 172.16.0.1:123 0.0.0.0:* 7734/ntpd udp ...
5
votes
1answer
479 views

Is ntpd running purely as a client vulnerable to the recent ntp vulnerabilities?

There's been 3 recent vulnerabilities in the NTP reference implementation. Namely: CVE-2014-9296 CVE-2014-9295 CVE-2014-9294 Is ntpd, or ntpdate, running as a client vulnerable to any of these ...
2
votes
1answer
766 views

Is it possible to cause a DOS attack on a domain by spoofing the DC's NTP request?

According to this page: Be aware that the Network Time Protocol (NTP) is unauthenticated, and unencrypted, and it is possible for an intruder to spoof the time root source, causing the wrong ...
3
votes
2answers
529 views

Does NTP leak local system time?

As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP ...
17
votes
3answers
2k views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
2
votes
1answer
243 views

Why don't servers vulnerable to NTP and DNS reflection attacks get blacklisted immediately?

With these reflection attacks, the source IP should be the IP of the vulnerable server. So shouldn't nodes which see abnormal amounts of NTP data be able to add the source to a blacklist and therefore ...
12
votes
4answers
1k views

How to safely synchronize time over Internet?

All modern OS now keep accurate time by regularly synchronizing time over an untrusted network - Internet. Could an attacker conducting a MITM attack, influence or change the time of a computer while ...
4
votes
2answers
2k views

Time server security error

Today at work, we brought out some PCs that were not used for a long time (were not in use when I joined this company so I have no idea about their history). After booting one of them (Windows XP ...
12
votes
4answers
8k views

Is NTP vulnerable to DNS poisoning or spoofing attacks?

Scenario: Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application) Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...