Attacking the Network Time Protocol
We explore the risk that network attackers can exploit unauthenticated Network Time Protocol (NTP) traffic to alter the time on client systems. We first discuss how an on-path attacker, that hijacks traffic to an NTP server, can quickly shift time on the server's clients. Then, we present an extremely low-rate (single packet) denial-of-service attack that an off-path attacker, located anywhere on the network, can use to disable NTP clock synchronization on a client. Next, we show how an off-path attacker can exploit IPv4 packet fragmentation to dramatically shift time on a client. We discuss the implications of these attacks on other core Internet protocols, quantify their attack surface using Internet measurements, and suggest a few simple countermeasures that can improve the security of NTP.
Bio: Sharon Goldberg is an associate professor in the Computer Science Department at Boston University. Her research uses tools from theory (cryptography, game-theory, algorithms), and networking (measurement, modeling, and simulation) to solve practical problems in network security. She received her Ph.D. from Princeton University in 2009, her B.A.Sc. from the University of Toronto in 2003, has worked as a researcher at IBM, Cisco, and Microsoft, as an engineer at Bell Canada and Hydro One Networks, and has served on working groups of the Federal Communications Commission (FCC) and the Internet Engineering Task Force (IETF). In 2014 she received two IETF/IRTF Applied Networking Research Prizes, an NSF CAREER Award, and a Sloan Research Fellowship.