RE: [Full-Disclosure] Security aspects of time synchronization infrastructure

["joe" <mvp@xxxxxxxxxxx>]

Interesting paper. I am curious about this statement though as you seemingly
don't give supporting information.

"If network is configured in accordance to these recommendations  it's
possible  to bring whole Windows 2003 forest down
with a single UDP packet." 

What is your line of reasoning here? In a properly configured forest, all
machines will take their time from their default time source and not from a
preconfigured machine as you outlined. If the time on the PDC emulator of
the forest is spanked into a new value, either the other machines will be
unable to sync with it due to not being able to authenticate with it or the
forest time will change and authentication will continue on. It could impact
kerberos certs in that they may need to be reissued sooner, but I fail to
see an issue where the entire forest could be brought down. I could see this
having adverse affects on MIT trusts and non-MS kerberos clients unless they
have the Vintela or Centrify *nix/Win integration software (or other
software configured to do the same) that forces a timesync with the Forest. 

If you would prefer to discuss offline, that is fine as well.

  Thanks, joe



-----Original Message-----
From: full-disclosure-admin@xxxxxxxxxxxxxxxx
[mailto:full-disclosure-admin@xxxxxxxxxxxxxxxx] On Behalf Of 3APA3A
Sent: Thursday, August 19, 2004 5:26 PM
To: bugtraq@xxxxxxxxxxxxxxxxx
Cc: full-disclosure@xxxxxxxxxxxxxxxx
Subject: [Full-Disclosure] Security aspects of time synchronization
infrastructure

Hello bugtraq,

  I    published   whitepaper   called   "Security   aspects   of   time
  synchronization  infrastructure".  It  describes  some observations on
  very  common  security  flaws  in  time synchronization infrastructure
  design, including (but not limited to) MS Windows Active Directory.

  http://www.security.nnov.ru/advisories/timesync.asp

  Any comments are very appreciated.

--
/3APA3A

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html