Questions tagged [time]
For security issues relating to the system time of a host, or relating real-world clocks more generally. Please use the tags [timestamp] or [performance] for questions on those topics.
37
questions
0
votes
0
answers
44
views
Making time(0) produce an error
I'm currently reviewing/reversing a software (coded in C) and it has a line like this :
time_t var = time(0);
My goal it to get this time(0) call to return -1.
(I cannot modify the parameter.)
...
- 1
1
vote
0
answers
525
views
Prevent browsers from providing time zone info to webservers
I use Cloudflare's Warp VPN all the time for regular browsing and yet I recently found that Patreon can tell the country I'm physically located in. It baffled me how it could do so; Patreon could tell ...
- 111
0
votes
0
answers
192
views
Could someone bypass a GPG key's expiration date by simply using that key on a computer with an incorrect system time?
I've heard it's good for security to have a shorter expiration time for GPG keys, but I'm still not clear on why that is exactly. Is the purpose of a GPG key mainly to inform the legitimate user that ...
1
vote
1
answer
145
views
Is "time locking" a good strategy for protecting data with HSMs?
I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
- 87
6
votes
1
answer
1k
views
Securely detecting and correcting time drift for TOTP
RFC 6238 recommends the server to implement some form of resynchronization algorithm to account for time drift of the device used to generate the OTP. However, the RFC provides very little information ...
5
votes
1
answer
326
views
How can wrong time synchronization be exploited?
It happened to me a few times that I installed a Windows PC after the CMOS battery has been replaced and all sorts of things stopped working or threw security warnings, only to realize that I just ...
- 229
0
votes
0
answers
107
views
In the time side channel, is there any way to improve the measurement time accuracy?
I want to measure the execution time of a function. The execution time of this function is only slightly different in the two cases. Is there any way I can accurately measure its time to distinguish ...
- 101
38
votes
8
answers
8k
views
Why does my digital bank need my phone date and hour to be correct?
I'm not from Information Security or any IT related area. But I want to know if there is any security reason for my digital bank to demand my phone to be on "Automatic Date & Time"?
For ...
- 493
0
votes
0
answers
251
views
How can a SOCKS5 proxy know client's datetime?
It seems that SOCKS5 proxies somehow know the client's timezone (at least) or maybe even the precise datetime. I determined this because the proxy tears the connection in case the local timezone on ...
- 101
3
votes
3
answers
244
views
Is server startup time sensitive information?
Let's say we have a web server. Server startup time is the time the server process was started.
Say, the startup time was being leaked via its response headers due to the carelessness of a ...
- 133
1
vote
3
answers
1k
views
Is it safe to assume that my computer's clock will always be synced with actual time within the second or a few seconds at the worst?
Years ago, I was running a service where the moderators were able to do various actions with massive privacy implications if the accounts or contributions were less than a short period of time. I did ...
- 11
3
votes
1
answer
511
views
Can AWS Time Sync be argued PCI compliant?
We're setting up a card processing service on Amazon AWS, and were wondering whether the AWS Time Sync service could be incorporated without running afoul of the PCI time sync requirements?
...
- 131
2
votes
1
answer
197
views
Secure way to update Date & Time of a Linux Embedded Device
I have a Linux (4.9.171) machine running on ARM Cortex-A processor. The system has internet connection and talks to my server over SSL. At the first boot, I can configure the date and time to it. ...
- 123
1
vote
1
answer
2k
views
Difference between system uptime and last boot time in windows
As it shows in attached pictures, there is a "Difference between system uptime and last boot time" in my windows, it becomes an issue because AV, SIEM or every monitoring system shows a different time ...
- 1,627
1
vote
1
answer
205
views
Is it possible to verify that a signature was made prior to the content of the document it is found on?
In What to do after I signed a blank sheet of paper given to me by my manager?, a distressed individual (B) has signed a blank piece of paper and given it to an adversary (A).
A has openly stated to ...
- 3,107
61
votes
9
answers
12k
views
How important is local time for security?
I recently wanted to see what happens when I change my local time to something obviously wrong. I tried the year 2218, so 200 years in the future. The result: I couldn't access any website anymore (I ...
- 3,914
5
votes
1
answer
780
views
What use does a TPM have for accurate timekeeping?
I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
- 66.3k
15
votes
2
answers
10k
views
What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?
RFC 7519 specifies an optional "iat" field, indicating when a token was issued. The RFC provides a terse commentary:
This claim can be used to determine the age of the JWT.
What is the ...
- 1,540
4
votes
2
answers
1k
views
Does x509 have an "issued at" timestamp? Can you tell when an x509 certificate was issued?
The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.
- 1,540
4
votes
1
answer
833
views
Can I disable access to JS APIs in the browser such as highres timers?
In the wake of recent news of CPU bugs like Meltdown and Spectre which rely on precise(-ish) measurments of elapsed time, I find myself in the mood for disabling things like window.performance.now() ...
- 161
1
vote
1
answer
170
views
How is resynchronization performed for security keys / MFA devices?
When a MFA (time based) device security key drifts out of synchronization there is a procedure to resynchronize it. But there is no input to the device itself.
Smartphone apps don't have this ...
- 315
2
votes
1
answer
107
views
Authorization expiration without reliable clock / time
I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
- 21
7
votes
2
answers
3k
views
How many known time/result combinations does it take to guess a HOTP/TOTP secret?
I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known.
In case we can view the live ...
- 6,427
38
votes
3
answers
12k
views
Why should memcmp not be used to compare security critical data?
From man 3 memcmp:
Do not use memcmp() to compare security critical data, such as
cryptographic secrets, because the required CPU time depends on the
number of equal bytes.
Instead, ...
- 5,717
6
votes
1
answer
1k
views
Mitigate Time Spoofing Attack
Say Alice receives synchronized time from Tina the timekeeper. Say Ted spoofs a GPS signal, fooling Tina about the current time. Tina sends this fake time to Alice.
What can Alice do to avoid being ...
- 1,540
5
votes
1
answer
560
views
Overall Security of Network Time Protocol
I am doing some research in order to get an understanding of the security of the Network Time Protocol. In particular, my goal was/is to understand how the protocol is secured and what the issues are.
...
- 159
1
vote
1
answer
1k
views
techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]
I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...
- 63
1
vote
5
answers
444
views
Does disclosing server local time to users cause any security risks?
I need to implement a number of web pages for resetting an API access key:
user must be logged in first
user gets to "confirmation" page that has a "confirmation" link with a time token inserted
user ...
- 2,221
7
votes
1
answer
7k
views
PHP Session Vulnerability
I'm trying to solve a challenge on a CTF, with PHP sessions.
The goal is to make check.php echo $_PASSWORD.
I do not have access to the files themselves, and therefore I cannot edit them.
My ...
- 139
1
vote
1
answer
1k
views
Can setting the date on your iPhone to the epoch really brick it? [closed]
So, I've started seeing warnings that there is a troll/hoax saying that people should set the date on their phone to 1st January 1970 to get a retro logo to display.
The warnings say that this will ...
- 139
32
votes
12
answers
15k
views
Could I recover the content of file from its checksum/hash?
Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file.
Now assume ...
- 565
1
vote
0
answers
141
views
How to get a completely isolated virtual time using Xen? [closed]
Referring to the following quote https://www.kernel.org/doc/Documentation/virtual/kvm/timekeeping.txt
4.8) Covert channels and leaks
In addition to the above problems, time information will ...
- 744
3
votes
3
answers
1k
views
Feasibility of time-based database brute-force attacks on websites
I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
- 75
0
votes
1
answer
100
views
Adobe PSIRT Average Response Time [closed]
Anyone have any experience in contacting the Adobe Product Security Incident Response Team (PSIRT)? I sent in an exploit that I found two weeks ago and I have not heard from them since. Would they ...
0
votes
2
answers
10k
views
AES algorithm encryption time
What is the time taken by an AES Encryption algorithm, with a key of 128 bits, operating on a normal computer (say with Intel i7) and what will be the impact be on the time if I wish to use a 256 bit ...
- 173
5
votes
1
answer
5k
views
Brute Forcing LUKS Full Disk Encryption - Time?
let's say we have encrypted our drive with AES 256 XTS and the following Hash:
SHA1 with ~500k Iterations and a 20+ password
SHA512 with ~250k Iterations and the same 20+ password.
Let's think of ...
- 303
2
votes
1
answer
407
views
Are servers that do not implement time services vulnerable to clock skew attacks?
An article describes clock skew attack possibilities §§:
These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
- 3,273