4 ms·
A port is a port is a port. You can send anything you like to that port and it's not like the computer will say "Oop, I have no programs listening on this port,
by GhotiFish 13y ago
A port is a port is a port. You can send anything you like to that port and it's not like the computer will say "Oop, I have no programs listening on this port, so I'll just execute what you're sending me"
What is the danger in having a port exposed that can receive updates for time? Are there huge vulnerabilities in the ntpd? Seems like a pretty small attack surface to me.
actually... Is that port even open?!
This is polling a time server through NAT right? So the ports get negotiated. We're not listening, were asking. So I guess the danger would be that your time server of choice could be compromised, and then start sending out malicious packets that... confuse ntpd? Seems like were back where we started.
There was some stupid stuff in that article, twitter updates being perhaps the most colossal (and voice control coming in a neat second, web control @ 3). However, once you take flame decals off and remove the card in the spokes, this ceases to be the danger it once was.
- zanny 13y agontpd is usually run as a daemon, which is run as root, and if you can overflow a buffer somewhere, given you know the architecture and platform (arm, raspberry pi), and don't have data execution prevention, you can inject assembly instructions and jump a function pointer like any other stack overflow. Then you have arbitrary code execution as ntpd. Unless you have apparmor, or some other MAC.
- desas 13y agontpd is usually ran as the ntp on debian based systems at least. Most rpi distros are debian based. Given that the same ntpd code is running on many many internet connected computers around the world, I don't think a microwave is worth a 0day remote root exploit on.