Skip to content

NTP time-shift MITM

1. Context & stakes

Shift the clock to invalidate TLS/Kerberos.

Hosts trust NTP to set their clock, and classic NTP is unauthenticated, so a man-in-the-middle can shift a victim's time arbitrarily. A wrong clock re-enables expired certificates, breaks Kerberos and TOTP, and can slip past validity windows in security tokens. Network Time Security authenticates the time source and closes the vector.

2. Theory

Many security checks depend on a correct clock - TLS validity windows, Kerberos ticket lifetimes, certificate expiry, TOTP. An on-path attacker who shifts a victim's clock via NTP can make expired certificates look valid or replayed tickets acceptable. NTS (Network Time Security) authenticates the time source.

3. Attack (PoC)

netlab-ntp attack --i-own-this-network --iface veth-host
  1. NTP MITM -> clock shift
  2. Break validity windows

4. Detection

netlab-ntp detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • NTS (Network Time Security)
  • Multiple authenticated sources

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading