1. 3

  2. 4

    He says the code used to send the fake packets can easily fit on a USB key.

    lol. Trying to imagine what kind of attack wouldn’t fit on a USB key.

    1. 3

      Skimming the linked post and the Wikipedia article it looks as if PTP is optimized for speed/accuracy, not security:

      According to John Eidson, who led the IEEE 1588-2002 standardization effort, “IEEE 1588 is designed to fill a niche not well served by either of the two dominant protocols, NTP and GPS. IEEE 1588 is designed for local systems requiring accuracies beyond those attainable using NTP. It is also designed for applications that cannot bear the cost of a GPS receiver at each node, or for which GPS signals are inaccessible.”

      (my emphasis)

      If you already have someone in your local network sending DoS packages you might have bigger issues than having your time signals out of sync.

      1. 3

        True, it is aimed at local networks.

        These kinds of protocols are used in industrial systems and as we’re moving towards a world where these industrial networks and devices attain internet connectivity (the Industrial Internet of Things), security is becoming increasingly important. Industrial system and protocol security is kind of like IoT security (spoiler: a joke), so the research is relevant, if not a bit obvious to any security-oriented individual[1].

        I remember looking at this protocol a month or so ago myself and just not knowing whether I should be laughing or crying. I thought this type of naive optimism was long gone in networked protocols. I think that the reason these types of papers are appearing now is because of this movement towards internet-connected industrial networks.

        [1] Going by the linked article, haven’t read the paper itself yet.

        1. 1

          You make good points. I’m unfamiliar with industrial systems but the global trend is towards “internet everything” so protocols developed in more comfortable times have to be updated or replaced.

          1. 1

            Maybe we should not put industrial sites on the internet.

            1. 1

              I mean, we can try, but physical security is never perfect. People tailgate into buildings. People find “lost” USB keys and plug them in to something to see what they do. People accept bribes. People working for state actors take jobs as janitors.