Preventing Time Synchronization in NTP's Broadcast Mode

Nikhil Tripathi,Neminath Hubballi

DOI: https://doi.org/10.48550/arXiv.2005.01783

2020-05-15

Abstract:Network Time Protocol (NTP) is used by millions of hosts in Internet today to synchronize their clocks. Clock synchronization is necessary for many network applications to function correctly. Unsynchronized clock may lead to failure of various core Internet services including DNS and RPKI based interdomain routing and opens path for more sophisticated attacks. In this paper, we describe a new attack which can prevent a client configured in NTP's broadcast mode from synchronizing its clock with the server. We test the attack in real networks and show that it is effective in both authenticated and unauthenticated broadcast/multicast modes of NTP. We also perform experiments to measure the overall attack surface by scanning the entire IPv4 address space and show that NTP broadcast mode is being used in the wild by several low stratum (highly accurate) hosts. We also suggest few countermeasures to mitigate the proposed attack.

Cryptography and Security,Networking and Internet Architecture

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the time - synchronization - attack problem in the NTP (Network Time Protocol) broadcast mode. Specifically, the paper describes a new attack method, which can prevent clients configured in the NTP broadcast mode from synchronizing their clocks with the server. By sending forged NTP packets to NTP clients and broadcast servers, attackers can interfere with the client's time - synchronization process, and this attack is effective even in authenticated and non - authenticated broadcast/multicast modes.

The main contributions of the paper include:
1. Proposing a new attack method that can prevent NTP clients from synchronizing time with NTP servers.
2. Testing the proposed attack in an actual network and demonstrating its effectiveness in authenticated and non - authenticated NTP broadcast/multicast modes.
3. Conducting extensive experiments by scanning the entire IPv4 address space to measure the attack surface on the Internet and providing result analysis, indicating that this is the lowest value of the actual attack surface on the Internet.
4. Suggesting several countermeasures that can be deployed to effectively deal with the proposed attack until a formal security patch is released.

The paper also discusses the background, operation modes, and built - in security mechanisms of the NTP protocol, explains in detail the discovered protocol vulnerabilities and how they can be exploited to launch attacks. In addition, the paper verifies the effectiveness of the attack through experiments and proposes specific attack steps for different scenarios (such as non - authenticated broadcast mode and authenticated broadcast mode). Finally, the paper shows the actual impact range of the attack through actual network tests and large - scale Internet scans and proposes mitigation measures.