Home page logo

bugtraq logo Bugtraq mailing list archives

RE: [Full-Disclosure] Security aspects of time synchronization infrastructure
From: "joe" <mvp () joeware net>
Date: Thu, 19 Aug 2004 18:59:06 -0400

Interesting paper. I am curious about this statement though as you seemingly
don't give supporting information.

"If network is configured in accordance to these recommendations  it's
possible  to bring whole Windows 2003 forest down
with a single UDP packet." 

What is your line of reasoning here? In a properly configured forest, all
machines will take their time from their default time source and not from a
preconfigured machine as you outlined. If the time on the PDC emulator of
the forest is spanked into a new value, either the other machines will be
unable to sync with it due to not being able to authenticate with it or the
forest time will change and authentication will continue on. It could impact
kerberos certs in that they may need to be reissued sooner, but I fail to
see an issue where the entire forest could be brought down. I could see this
having adverse affects on MIT trusts and non-MS kerberos clients unless they
have the Vintela or Centrify *nix/Win integration software (or other
software configured to do the same) that forces a timesync with the Forest. 

If you would prefer to discuss offline, that is fine as well.

  Thanks, joe

-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com] On Behalf Of 3APA3A
Sent: Thursday, August 19, 2004 5:26 PM
To: bugtraq () securityfocus com
Cc: full-disclosure () lists netsys com
Subject: [Full-Disclosure] Security aspects of time synchronization

Hello bugtraq,

  I    published   whitepaper   called   "Security   aspects   of   time
  synchronization  infrastructure".  It  describes  some observations on
  very  common  security  flaws  in  time synchronization infrastructure
  design, including (but not limited to) MS Windows Active Directory.


  Any comments are very appreciated.


Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]