4 ms·
NTP takes in untrusted input from the net, does complex processing on it, and requires the ability to do something administrative on your system (adjust the tim
by bsder 4y ago
NTP takes in untrusted input from the net, does complex processing on it, and requires the ability to do something administrative on your system (adjust the time).
This gives NTP a lot of attack surface and makes it a likely vector for compromise.
Rewriting NTP in any language safer than C/C++ is likely to be a good idea.
- yencabulator 4y agoThat drives home the point that NTP would likely benefit from privilege separation too. One component talks to the network, another component adjusts time. Second component would enforce gradual skewing only. (Or a time jump once in early boot, per policy. And it could enforce the max size of that jump too, implement a policy where the machine boots into repair mode if it was more than 5 minutes off the desired time, etc.) A very simple one-way data channel between the components would make attacking the second component near impossible. With that, and an attacker that completely pwns component 1: At worst they could start a very gradual skew, which could then be picked up by monitoring before it causes much of an issue.