Are NTP Clients Always Right?#

Shreyas Konjerla, TU Delft

• Why: Time infrastructure trust underpins everything else — TLS, Kerberos, log forensics — but client-side NTP hardening is rarely examined. This stress-tests the default time clients of major operating systems and finds the weakest of them are trivially manipulable.
• What: Eight (S)NTP clients across three OSes were baselined for 60 hours and then attacked. All SNTP clients — the defaults of major OSes — are vulnerable to time-shift attacks (macOS accepted injected offsets from 900 s up to two years); none of the full NTP clients were. Five bugs and one vulnerability were disclosed, including: NTPD-RS flooded with queries under certain Kiss-of-Death packets, OpenNTPd unable to handle the NTP timestamp rollover, and TimesyncD using a single server (a single point of failure). Also forecast: Ubuntu's planned default move to NTS/chrony will multiply query volume ~11x and traffic ~25x per host.
• How: Controlled testbed of three local NTP servers with a threat model of malicious-server redirection (via NTP pool or DNS hijack); clients measured for query behavior, server rotation, and spec compliance.
• Where applicable: Directly actionable for fleet configuration choices (which client, how many servers, panic thresholds); thesis-scale work but with real vendor disclosures. The Ubuntu/NTS traffic forecast matters to anyone operating NTP infrastructure at enterprise or ISP scale.