Subject: [TICTOC] new threat for time protocols

From: Yaakov Stein <[email-masked]>
Date: Thu, 13 Nov 2014 02:17:30 +0000

At today's session I heard a new threat that we have not previously discussed.

If I understand the threat correctly, it exploits the fact that NTP requests are relatively common from all hosts,
and thus could be used for traffic analysis and topology discovery purposes.

Authentication and integrity, which we have been mandating, obviously are of no use against this threat,
and neither is confidentiality of NTP payloads (since all that is needed for the attack is the packet header).
Nor does IPsec tunnel mode help if we open a tunnel from near every host to the NTP server.

So, do we have a solution ?

In any case, I don't see how this threat strengthens the need for encryption of time packets.

Y(J)S

---

From: Yaakov Stein <[email-masked]>
Date: Thu, 13 Nov 2014 20:46:24 +0000

Just to clarify (several people have emailed me off-line)
this is not a threat to the timing service,
it is a threat to the infrastructure made possible because of the timing traffic.

In that sense it is similar to the NTP DDoS attack.

Y(J)S

From: TICTOC [mailto:[email-masked]] On Behalf Of Yaakov Stein
Sent: 13 November, 2014 04:18
To: [email-masked]
Subject: [TICTOC] new threat for time protocols

Y(J)S

---

From: Brian Haberman <[email-masked]>
Date: Thu, 13 Nov 2014 16:02:08 -0500

Hi Yaakov,

> In that sense it is similar to the NTP DDoS attack.

Can you explain more?  I am not sure how it is similar to the DDoS
attack.  Yes, you can analyze the traffic and discover the addresses of
the devices on the network, but that is not an active attack like the
DDoS one.

Regards,
Brian