1. The Security of NTP's Datagram Protocol 2017 FinancialCryptography Network Protocols
    Aanchal Malhotra, Matthew Van Gundy, Mayank Varia, Haydn Kennedy, Jonathan Gardner, Sharon Goldberg
    [View PDF on fc17.ifca.ai]
    [Show BibTex Citation]

    author = {Aanchal Malhotra and
    Matthew Van Gundy and
    Mayank Varia and
    Haydn Kennedy and
    Jonathan Gardner and
    Sharon Goldberg},
    editor = {Aggelos Kiayias},
    title = {The Security of NTP's Datagram Protocol},
    booktitle = {Financial Cryptography and Data Security - 21st International Conference,
    {FC} 2017, Sliema, Malta, April 3-7, 2017, Revised Selected Papers},
    series = {Lecture Notes in Computer Science},
    volume = {10322},
    pages = {405--423},
    publisher = {Springer},
    year = {2017},
    url = {https://doi.org/10.1007/978-3-319-70972-7\_23},
    doi = {10.1007/978-3-319-70972-7\_23},
    timestamp = {Tue, 14 May 2019 10:00:38 +0200},
    biburl = {https://dblp.org/rec/bib/conf/fc/MalhotraGVKGG17},
    bibsource = {dblp computer science bibliography, https://dblp.org}

For decades, the Network Time Protocol (NTP) has been used to synchronize computer clocks over untrusted network paths. This work takes a new look at the security of NTP’s datagram protocol. We argue that NTP’s datagram protocol in RFC5905 is both underspecified and flawed. The NTP specifications do not sufficiently respect (1) the conflicting security requirements of different NTP modes, and (2) the mechanism NTP uses to prevent off-path attacks. A further problem is that (3) NTP’s control-query interface reveals sensitive information that can be exploited in off-path attacks. We exploit these problems in several attacks that remote attackers can use to maliciously alter a target’s time. We use network scans to find millions of IPs that are vulnerable to our attacks. Finally, we move beyond identifying attacks by developing a cryptographic model and using it to prove the security of a new backwards-compatible client/server protocol for NTP.