Quantitative Risk Analysis of Network Time Protocol (NTP) Spoofing Attacks

The Network Time Protocol (NTP) is one of the oldest Internet protocols, in use by millions of devices today. It performs the important function of synchronizing a host’s system clock to that of an accurate time server across a network — usually the public Internet. The objective of this study was to quantify the risk of a time spoofing attack on unsecured NTP and find out exactly what it takes for such an attack to be successful, through practical experiments with four popular NTP implementations: ntpd, NTPSec, chrony, and OpenNTPD. Results showed that an in-path (man-in-the-middle) attacker will always succeed in impersonating an NTP server; an on-path attacker will only succeed if their responses reach the client first; and an off-path attacker has little to no chance of succeeding. Results also showed that with default settings and no authentication, a chrony NTP client is the most difficult to attack, followed by OpenNTPD, then NTPSec, and finally ntpd (least secure). A novel formula is presented which can be used to determine — given a particular NTP client’s settings — how much time it would take for an attacker to successfully alter the victim’s clock by a given magnitude. As an example, altering an ntpd or NTPSec client’s clock by 1 hour takes around 12 minutes, whereas doing the same to a chrony or OpenNTPD client would take around 10 hours. Finally, symmetric-key and Network Time Security (NTS) authentication are proven to thwart even the strongest attacker.