{"id":84016,"date":"2017-05-12T17:32:10","date_gmt":"2017-05-12T21:32:10","guid":{"rendered":"http:\/\/rbachnet.wwwmi3-ss40.a2hosted.com\/index.php\/"},"modified":"2022-01-13T17:09:22","modified_gmt":"2022-01-13T22:09:22","slug":"whose-time-is-it","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/whose-time-is-it\/","title":{"rendered":"Whose Time Is It?"},"content":{"rendered":"<p><a href=\"https:\/\/www.pinterest.com\/Budzirka\/plywood-clock-idea\/\" target=\"_blank\" rel=\"noopener noreferrer\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-104464\" title=\"Whose Time Is It?\" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/stealing_time-e1568498669418-120x150.jpeg?resize=88%2C110&#038;ssl=1\" alt=\"Whose Time Is It?\" width=\"88\" height=\"110\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/stealing_time-e1568498669418.jpeg?resize=120%2C150&amp;ssl=1 120w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/stealing_time-e1568498669418.jpeg?resize=60%2C75&amp;ssl=1 60w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/stealing_time-e1568498669418.jpeg?w=200&amp;ssl=1 200w\" sizes=\"auto, (max-width: 88px) 100vw, 88px\" \/><\/a>What time is it? If you looked at the lower right corner of your Windows PC screen, you know what time it is. That is good enough for most people, but followers of the <a href=\"https:\/\/rbach.net\/\" target=\"_blank\" rel=\"noopener noreferrer\"><em>Bach Seat<\/em><\/a> want to know more. How does Microsoft know that time it is? Microsoft and everybody else uses <a href=\"https:\/\/tools.ietf.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">Internet Engineering Task Force<\/a> (IETF) <a href=\"https:\/\/tools.ietf.org\/html\/rfc7822\" target=\"_blank\" rel=\"noopener noreferrer\">RFC 7822<\/a> standard protocol called <strong><a href=\"https:\/\/web.archive.org\/web\/20230130111811\/http:\/\/www.ntp.org\/ntpfaq\/NTP-s-def.htm\" target=\"_blank\" rel=\"noopener noreferrer\">Network Time Protocol<\/a><\/strong> (NTP).<\/p>\n<h3>Network Time Protocol (NTP)<\/h3>\n<p><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignright wp-image-104466 size-thumbnail\" title=\"Network Time Protocol (NTP)\" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntp_time_servers.jpg?resize=75%2C50&#038;ssl=1\" alt=\"Network Time Protocol (NTP)\" width=\"75\" height=\"50\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntp_time_servers.jpg?resize=75%2C50&amp;ssl=1 75w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntp_time_servers.jpg?resize=150%2C99&amp;ssl=1 150w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntp_time_servers.jpg?w=290&amp;ssl=1 290w\" sizes=\"auto, (max-width: 75px) 100vw, 75px\" \/><a href=\"https:\/\/en.wikipedia.org\/wiki\/Network_Time_Protocol\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>NTP<\/strong><\/a> is one of the oldest <strong><a href=\"https:\/\/en.wikipedia.org\/wiki\/Internet_protocol_suite\" target=\"_blank\" rel=\"noopener noreferrer\">Internet protocols<\/a><\/strong> still in use. NTP was designed by <a href=\"http:\/\/umich.edu\/\" target=\"_blank\" rel=\"noopener noreferrer\">UMich<\/a> alum <a href=\"https:\/\/web.archive.org\/web\/20210420222900\/https:\/\/www.nwtime.org\/bio\/david-l-mills\/\" target=\"_blank\" rel=\"noopener noreferrer\">David Mills<\/a> at the <a href=\"https:\/\/www.eecis.udel.edu\/~mills\/\" target=\"_blank\" rel=\"noopener noreferrer\">University of Delaware<\/a>. NTP can <strong>maintain time<\/strong> to within tens of milliseconds over the public Internet, and better than one-millisecond accuracy on a LAN. Like many other things in the network world, NTP is set up as a hierarchy. At the top of the tree are \u201c<strong><a title=\"Atomic clock\" href=\"http:\/\/en.wikipedia.org\/wiki\/Atomic_clock\" target=\"_blank\" rel=\"wikipedia nofollow noopener noreferrer\">Atomic Clocks<\/a><\/strong>\u201d (Stratum 0). <a href=\"http:\/\/time.google.com\" target=\"_blank\" rel=\"noopener noreferrer\">Corporations<\/a>, <a href=\"https:\/\/tf.nist.gov\/tf-cgi\/servers.cgi\" target=\"_blank\" rel=\"noopener noreferrer\">governments<\/a>, and the <a href=\"https:\/\/web.archive.org\/web\/20220806093829\/http:\/\/www.cnmoc.usff.navy.mil\/Organization\/United-States-Naval-Observatory\/Precise-Time-Department\/Network-Time-Protocol-NTP\/US-Eastern-Time-Zone-NTP-Servers\/\" target=\"_blank\" rel=\"noopener noreferrer\">military<\/a> run atomic clocks.<\/p>\n<p><a href=\"https:\/\/web.archive.org\/web\/20190906105049\/https:\/\/tycho.usno.navy.mil\/NTP\/\" target=\"_blank\" rel=\"noopener noreferrer\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-104468\" title=\"USNO NTP Servers\" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntpservers.jpg?resize=400%2C300&#038;ssl=1\" alt=\"USNO NTP Servers\" width=\"400\" height=\"300\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntpservers.jpg?w=720&amp;ssl=1 720w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntpservers.jpg?resize=75%2C56&amp;ssl=1 75w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ntpservers.jpg?resize=150%2C113&amp;ssl=1 150w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/a>Atomic clocks are <strong>high-precision timekeeping devices<\/strong> that use the element <strong><a href=\"https:\/\/www.livescience.com\/37578-cesium.html\" target=\"_blank\" rel=\"noopener noreferrer\">cesium<\/a><\/strong>, which has a frequency of 9,192,631,770 Hertz. That means it &#8220;oscillates&#8221; a little over nine billion times a second. Knowing the oscillation frequency and then measuring it in a device creates an incredibly accurate timekeeping mechanism. Atomic clocks generate a very accurate interrupt and timestamp on a connected Stratum 1 computer. Stratum 0 devices are also known as reference clocks. The other stratum levels are:<\/p>\n<p style=\"padding-left: 30px;\"><strong>1<\/strong> &#8211; These are computers attached to stratum 0 devices. Stratum 1 servers are also called &#8220;primary time-servers&#8221;.<\/p>\n<p style=\"padding-left: 30px;\"><strong>2<\/strong> &#8211; These are computers that synchronize over a network with stratum 1 servers. Stratum 2 computers may also peer with other <a href=\"http:\/\/support.ntp.org\/bin\/view\/Servers\/StratumTwoTimeServers\" target=\"_blank\" rel=\"noopener noreferrer\">stratum 2<\/a> computers to offer more stable and robust time for all devices in the peer group.<\/p>\n<p style=\"padding-left: 30px;\"><strong>3<\/strong> computers synchronize with stratum 2 servers. They use the same rules as stratum 2, and can themselves act as servers for stratum 4 computers, and so on.<\/p>\n<p><a href=\"https:\/\/www.nist.gov\/news-events\/news\/2014\/02\/new-era-atomic-clocks\" target=\"_blank\" rel=\"noopener noreferrer\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignright wp-image-104471\" title=\"First gen time server\" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/first_atomic_clock.jpg?resize=100%2C120&#038;ssl=1\" alt=\"First gen time server\" width=\"100\" height=\"120\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/first_atomic_clock.jpg?resize=125%2C150&amp;ssl=1 125w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/first_atomic_clock.jpg?resize=63%2C75&amp;ssl=1 63w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/first_atomic_clock.jpg?w=271&amp;ssl=1 271w\" sizes=\"auto, (max-width: 100px) 100vw, 100px\" \/><\/a>Once synchronized, with a stratum 1, 2, or 3 server, the client updates the clock about once every 10 minutes, usually requiring only a single message exchange. The NTP process uses <a href=\"https:\/\/web.archive.org\/web\/20170821110117\/http:\/\/searchmicroservices.techtarget.com:80\/definition\/UDP-User-Datagram-Protocol\" target=\"_blank\" rel=\"noopener noreferrer\">User Datagram Protocol<\/a> <a title=\"Network Time Protocol\" href=\"http:\/\/en.wikipedia.org\/wiki\/Network_Time_Protocol\" target=\"_blank\" rel=\"wikipedia nofollow noopener noreferrer\">port 123<\/a>. The NTP timestamp message is 64-bits and consists of a 32-bit part for seconds and a 32-bit part for the fractional second. 64-bits gives NTP a time scale of 232 seconds (136 years) and a theoretical resolution of 232 seconds (233 picoseconds). NTP uses an <a href=\"https:\/\/en.wikipedia.org\/wiki\/Epoch_(reference_date)\" target=\"_blank\" rel=\"noopener noreferrer\">epoch<\/a> of January 1, 1900, so the first rollover will be on February 7, 2036.<\/p>\n<h3>Microsoft Windows Time Service<\/h3>\n<p><strong><a title=\"Microsoft\" href=\"http:\/\/www.microsoft.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft<\/a><\/strong> (<a title=\"NASDAQ | MSFT\" href=\"https:\/\/www.google.com\/finance?cid=358464\" target=\"_blank\" rel=\"noopener noreferrer\">MSFT<\/a>) has a mixed history of complying with NTP. All Microsoft Windows versions since Windows 2000 include the <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows-server\/identity\/ad-ds\/get-started\/windows-time-service\/how-the-windows-time-service-works\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Windows Time service<\/strong><\/a> (&#8220;W32Time&#8221;) which was originally implemented to support the Kerberos version 5 authentication protocol. It required time to be within 5 minutes of the correct value to prevent replay attacks. The NTP version in Windows 2000 and XP violates several aspects of the NTP standard. Beginning with Windows Server 2003 and Vista, MSFT\u2019s NTP was reliable to 2 seconds. Windows Server 2016 can now support 1ms time accuracy.<\/p>\n<p>In 2014 a new NTP client, <strong>ntimed<\/strong>, was started. As of May 2017, no official release was done yet, but ntimed can synchronize clocks reliably under <strong><a href=\"https:\/\/www.debian.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">Debian<\/a><\/strong> and <strong><a href=\"https:\/\/www.freebsd.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">FreeBSD<\/a><\/strong>, but has not been ported to Windows or\u00a0<a title=\"Apple Computers\" href=\"http:\/\/www.apple.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Apple<\/a> (<a title=\"NASDAQ : AAPL\" href=\"https:\/\/www.tradingview.com\/symbols\/NASDAQ-AAPL\/\" target=\"_blank\" rel=\"noopener noreferrer\">AAPL<\/a>) macOS.<\/p>\n<p>Accurate time across a network is <strong>important<\/strong> for many reasons; discrepancies of even fractions of a second can cause problems. For example:<\/p>\n<ul>\n<li><strong>Distributed procedures<\/strong> depend on coordinated times to make sure proper sequences are followed.<\/li>\n<li><strong>Authentication protocols<\/strong> and other security mechanisms depend on consistent timekeeping across the network.<\/li>\n<li><strong>File-system<\/strong> updates carried out by a number of computers depend on synchronized clock times.<\/li>\n<li><strong>Network acceleration<\/strong> and <strong>network management<\/strong> systems also rely on the accuracy of timestamps to measure performance and troubleshoot problems.<\/li>\n<li>Each individual <a href=\"http:\/\/www.businessinsider.com\/what-is-blockchain-2016-3\/#blockchains-are-ledgers-like-excel-spreadsheets-but-they-accept-inputs-from-lots-of-different-parties-the-ledger-can-only-be-changed-when-there-is-a-consensus-among-the-group-that-makes-them-more-secure-and-it-means-theres-no-need-for-a-central-authority-to-approve-transactions-1\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>blockchain<\/strong><\/a> includes a timestamp representing the approximate time the block was created.<\/li>\n<\/ul>\n<h3>NTP vulnerabilities<\/h3>\n<p>NTP has <a href=\"https:\/\/en.wikipedia.org\/wiki\/NTP_server_misuse_and_abuse\" target=\"_blank\" rel=\"noopener noreferrer\">known vulnerabilities<\/a>. The protocol can be <a href=\"https:\/\/arstechnica.com\/security\/2014\/01\/dos-attacks-that-took-down-big-game-sites-abused-webs-time-synch-protocol\/\" target=\"_blank\" rel=\"noopener noreferrer\">exploited<\/a> and used in <strong><a href=\"http:\/\/searchsecurity.techtarget.com\/definition\/distributed-denial-of-service-attack\" target=\"_blank\" rel=\"noopener noreferrer\">distributed denial of service<\/a><\/strong> (<a title=\"Denial-of-service attack\" href=\"http:\/\/en.wikipedia.org\/wiki\/Denial-of-service_attack\" target=\"_blank\" rel=\"wikipedia nofollow noopener noreferrer\">DDoS<\/a>) attacks for two reasons: First, it will reply to a packet with a spoofed source IP address; second, at least one of its built-in commands will send a long reply to a short request.<\/p>\n<p><a href=\"http:\/\/www.npl.co.uk\/educate-explore\/factsheets\/atomic-timekeeping\/\" target=\"_blank\" rel=\"noopener noreferrer\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignright wp-image-104473\" title=\"Ion-trap time source\" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ion_trap_time_server.jpg?resize=127%2C100&#038;ssl=1\" alt=\"Ion-trap time source\" width=\"127\" height=\"100\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ion_trap_time_server.jpg?resize=150%2C118&amp;ssl=1 150w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ion_trap_time_server.jpg?resize=75%2C59&amp;ssl=1 75w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/ion_trap_time_server.jpg?w=285&amp;ssl=1 285w\" sizes=\"auto, (max-width: 127px) 100vw, 127px\" \/><\/a>More vulnerabilities were recently discovered in NTP. <em><a href=\"http:\/\/searchsecurity.techtarget.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">SearchSecurity.com<\/a><\/em> <a href=\"http:\/\/searchsecurity.techtarget.com\/answer\/How-can-enterprises-fix-the-NTP-daemon-vulnerability-to-DoS-attacks\" target=\"_blank\" rel=\"noopener noreferrer\">reports<\/a> that security researcher Magnus Stubman discovered the vulnerability and, instead of going public, took the mature route and privately informed the community of his findings. Mr. Stubman <a href=\"http:\/\/dumpco.re\/cve-2016-7434\/\" target=\"_blank\" rel=\"noopener noreferrer\">wrote<\/a> that the vulnerability he discovered could allow <strong>unauthenticated users to crash NTPF<\/strong> with a single malformed UDP packet, which will cause a null point dereference. The article explains this means that an attacker could be able to craft a special UDP packet that targets NTP, resulting in an exception bypass that can crash the process. <strong>A patch to remediate<\/strong> specific vulnerability &#8212; <a href=\"https:\/\/web.archive.org\/web\/20220330063533\/https:\/\/www.nwtime.org\/ntp428p9_release\/\" target=\"_blank\" rel=\"noopener noreferrer\">named NTP 4.2.8p9<\/a>\u00a0 &#8212; was released by the <a href=\"https:\/\/web.archive.org\/web\/20181112231457\/http:\/\/www.networktimefoundation.org:80\/\" target=\"_blank\" rel=\"noopener noreferrer\">Network Time Foundation Project<\/a>.<\/p>\n<p>This is a <strong>Windows-only vulnerability<\/strong> at this time. The author urges anyone running the NTP daemon on a Windows system to patch it as soon as possible. This particular DoS attack against NTP could incapacitate a time-server and cause havoc in the network. The easiest fix is to apply the NTP patch the article states.<\/p>\n<p><strong><em>rb-<\/em><\/strong><br \/>\n<em>NTP is important to your network and patching and protecting it should be a priority. The threat to your environment is real. If NTP is not patched, an attacker could take advantage of the chaos created by this vulnerability to hide their tracks since timestamps on files and in logs won\u2019t match. <\/em><\/p>\n<p><em>Way back in the day, when I was a network administrator, I inherited a network where a directory services container was frozen. Seems that time had never been properly set up on the server holding the replica and as time passed, the server time drifted away from network time and at some point, we could not make changes or force a replica update. That meant a late-night call to professional services to kill the locked objects and then apply DSRepair \u2013xkz (I think) and then re-install a R\/O replica.<\/em><\/p>\n<h6>Related articles<\/h6>\n<ul>\n<li><a href=\"http:\/\/www.businessinsider.com\/a-leap-second-will-make-2016-a-little-longer-2016-12\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">A &#8216;leap second&#8217; will make 2016 a little longer<\/a> (businessinsider.com)<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><em><a title=\"Ralph Bach\" href=\"https:\/\/rbach.net\/index.php\/new-resume\/\" target=\"_blank\" rel=\"noopener noreferrer\">Ralph Bach<\/a>\u00a0has been in IT long enough to know better and has blogged from his\u00a0<a title=\"Bach Seat\" href=\"https:\/\/rbach.net\/\" target=\"_blank\" rel=\"noopener noreferrer\">Bach Seat<\/a> about IT, careers, and anything else that catches his attention since 2005. You can follow him on <a class=\"broken_link\" href=\"http:\/\/www.linkedin.com\/in\/rb48334\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">LinkedIn<\/a>,\u00a0<a href=\"https:\/\/www.facebook.com\/ralph.bach.14\" target=\"_blank\" rel=\"noopener noreferrer\">Facebook<\/a>,\u00a0and\u00a0<a href=\"https:\/\/twitter.com\/rbach48334\" target=\"_blank\" rel=\"noopener noreferrer\">Twitter<\/a>. Email the Bach Seat\u00a0<a href=\"mailto:\/\/bach.seat@gmail.com\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cyberriminals can exploit how the Internet keeps time to crash servers and DDoS sites time to patch NTP servers<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[2990,420,101,2912,2754,1748,2913,2914,536,92,82,421,2910,4,2911,1501],"class_list":["post-84016","post","type-post","status-publish","format-standard","hentry","category-security","tag-2990","tag-aapl","tag-apple","tag-atomic-clock","tag-blockchain","tag-ddos","tag-debian","tag-freebsd","tag-goog","tag-google","tag-microsoft","tag-msft","tag-ntp","tag-security","tag-udp-123","tag-vulnerability"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts\/84016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/comments?post=84016"}],"version-history":[{"count":23,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts\/84016\/revisions"}],"predecessor-version":[{"id":128166,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts\/84016\/revisions\/128166"}],"wp:attachment":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/media?parent=84016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/categories?post=84016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/tags?post=84016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}