How important is local time for security?

I recently wanted to see what happens when I change my local time to something obviously wrong. I tried the year 2218, so 200 years in the future. The result: I couldn't access any website anymore (I didn't try too many, though). I got this error:

I guess NET::ERR_CERT_DATE_INVALID means that an HTTPs certificate is not valid. But usually there is an "advanced" option that allows me to ignore it. Not so here. Also, I wonder why it says "your clock is ahead" - if chrome knows the correct time, why doesn't it take this for comparing?

NET::ERR_CERT_DATE_INVALID

Coming to my question: How important is local time for security? If an attacker can arbitrarily change the system time, which kinds of attacks allows this? Are there reported cases where time manipulation was a crucial part?

9 Answers
9

If an attacker can arbitrarily change the system time, which kinds of attacks allows this?

Beyond certificates...

Poorly seeded RNGs

They may be able to exploit a poorly seeded random number generator. Using time as a seed used to happen a lot before better random number interfaces realized your average programmer can't be trusted to provide a good seed. An attacker can exploit this by setting the system time to a time where the random number generator will produce their desired output.

time

Of course, the attacker can save themselves a lot of hassle by simply waiting for a desirable time.

UUIDs

UUIDv1 and v2 both depend on the MAC address and the time. The MAC address can be discovered. Being able to set the time means they can now control which UUID is assigned next. For example, they may be able to duplicate the UUID of an administrative account for themselves. Of course, UUIDv1 and v2 are not meant to be secure, they're just meant to be unique. If you want secure and unique you use UUIDv4, but there's plenty of software which uses UUIDv1 and v2 inappropriately.

Periodic jobs

Many systems have critical processes which run periodically at certain days and times. The attacker can mess with the time to manipulate this.

Many systems have maintenance windows which occur at certain times. The attacker could continuously reset the time to remain in this window and keep the system down for maintenance.

If there is a resource intensive process which occurs periodically, they can mess with the time such that multiple of those processes are running at the same time. If the system does not limit the number of simultaneous processes this can swamp the system.

Or you can go the other way and continuously reset the time to prevent a critical maintenance process from running.

Watchdogs

The system may have watchdog processes which look for too many or too few actions happening in a window of time. The watchdog may choose to take automatic maintenance action such as restarting machines or stopping services. An attacker can manipulate the time to make it seem as if the rate is too high or too low tripping the watchdog and causing it to halt a working system.

time

srand

srand(time());

srand

You have a bunch of questions rolled in there.

I guess NET::ERR_CERT_DATE_INVALID means that an HTTPs certificate is not valid.

Yes.

Here is the cert for help.ubuntu.com:

help.ubuntu.com

You'll notice that it has Valid From and Valid Until dates; if you try to access a site protected by this cert outside of these dates, your browser will complain. The reason certs expire is (among other reasons) to force webmasters to keep getting new certs using the latest crypto and other new security features in certificates.

When your browser is trying to decide if it trusts a certificate, it uses the system clock as the definitive source of truth for time. Sure, it'll try to use NTP, but if you (the admin user) have explicitly told it that the NTP servers are wrong, well, you're the boss.

If an attacker can arbitrarily change the system time, which kinds of attacks allows this?

Let's consider personal computers and servers separately. I haven't done any research here, just off the top of my head.

One reason is that certificate revocation records are not kept after the certificate expires.

Suppose I stole Google's certificate 10 years ago. Google immediately noticed and revoked their certificate. Since the certificate expired some time in the last 10 years, the revocation entry was deleted. If I set your clock back 10 years to when it was valid, I can impersonate Google and your browser won't notice, because it won't know it was revoked.

Your question is broad, but if an attacker can change the local system clock, then they can poison the logs of their activity. That way, they can hide their activity to appear to have occurred sometime in the past (and maybe beyond the window that the admins are looking for activity) or to coincide with other user's activity.

For example, if you break into a system in the middle of the night, you can set the clock to be at noon the previous day, do your activity, then set the clock back. Anyone inspecting the logs will assume the normal user did the activity (or not see it at all among the normal user's activity).

This is why setting your clock to be synced with an authoritative external source is important. That, and that all logs from all sources can be properly correlated.

for i in range(1, len(loglines)): if loglines[i]['time'] < logline[i-1]['time']: print("line has fraudulent time".format(i))

There would be two possible situations where a computer that thinks the year is 2038 tries to connect to the outside world, and everything in the outside world says that it is 2018:

The computer's clock is wrong.

The year is actually 2038, and everything in what seems to be the outside world is being faked, using certificates from 2018 that have been cracked in the 20 years since then.

Although attacks of that form would be hard enough to pull off that the first possibility would in practice be far more likely, guarding against the second would require getting confirmation that the computer's clock actually is wrong.

If you are running a single Windows Domain Controller, or part of it's network, a time difference of only five, or a few minutes can be critical: Kerberos Time Tolerance

I once had to deal with a failed Windows SBS 2008 Server and had to find a way to get in as SYSTEM to read the Event Log.

It turned out that a power surge had reset the CMOS BIOS clock on the Domain Controller, back to the system design date, some years before. The result being that Kerberos tickets could not be issued.

Kerberos tickets are valid for just a few minutes.

Another (slightly convoluted) example of an attack against a computer with lagging system time is serving outdated DNS records from a zone secured with DNSSEC.

For example, if client asked for www.example.com address, the attacker could reply with a referral to his own DNS server and an (expired) proof of non-existence of a DS record for example.com from the time when example.com was not yet signed, and subsequently serve forged DNS records for anything in example.com zone.

It could be considered faking and not having the computer clock synced always could have its advantages and disadvantages. Obvious ones are those already pointed.
One advantage is websites will not know your real date, although this would enter more into privacy than security per se, normally privacy is considered part of security.

I don't know much about NTP enumeration but its used in pentesting so it's a factor to take into account for security.

"The Network Time Protocol is a protocol for synchronizing time across
your network, this is especially important when utilizing Directory
Services. There exists a number of time servers throughout the world
that can be used to keep systems synced to each other. NTP utilizes
UDP port 123. Through NTP enumeration you can gather information such
as lists of hosts connected to NTP server, IP addresses, system names,
and OSs running on the client system in a network. All this
information can be enumerated by querying NTP server." source: "https://www.greycampus.com/opencampus/ethical-hacking/ntp-enumeration"

Many software, especially those that are working in a cluster, time sync is very important. So if someone messes with the time then the software running on this system will cause a lot of issues, especially with sync. This will eventually count as service impacting.

Thanks for contributing an answer to Information Security Stack Exchange!

But avoid …

To learn more, see our tips on writing great answers.

Required, but never shown

Required, but never shown

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.