New attacks on Network Time Protocol can defeat HTTPS and create chaos

[J65nko]

From http://arstechnica.com/security/2015...-create-chaos/

Serious weaknesses in the Internet's time-synchronization mechanism can be exploited to cause debilitating outages, snoop on encrypted communications, or tamper with Bitcoin transactions, computer scientists warned Wednesday.

The vulnerabilities reside in the Network Time Protocol, the widely used specification computers use to ensure their internal clocks are accurate. Surprisingly, connections between computers and NTP servers are rarely encrypted, making it possible for hackers to perform man-in-the-middle attacks that reset clocks to times that are months or even years in the past. In a paper published Wednesday titled Attacking the Network Time Protocol, the researchers described several techniques to bypass measures designed to prevent such drastic time shifts. The paper also described ways to prevent large numbers of computers from successfully connecting to synchronization servers.

[jggimi]

http://www.undeadly.org/cgi?action=a...20150210103656

This is a feature that was included with OpenBSD 5.7. Provisioning is described in the CONSTRAINTS section of the ntpd.conf(5) man page.

[Monti]

Thanks a lot @jggimi

[Carpetsmoker]