On Borrowed Time: Measurement-Informed Understanding of the NTP Pool's Robustness to Monopoly Attacks

On Borrowed Time: Measurement-Informed Understanding of the NTP Pool's Robustness to Monopoly Attacks

Speakers: Robert Beverly

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=g7jMu3WKeSU

Overview

This research presents the first exhaustive characterization of the NTP pool -- the volunteer-based, crowdsourced time distribution system that serves as critical internet infrastructure for millions of embedded and IoT devices worldwide. By reverse-engineering the NTP pool's web APIs, the researchers were able to completely enumerate all servers, accounts, and country zones without the noisy DNS-based enumeration methods used in prior work.

The findings are sobering: only 20% of NTP pool servers are truly independent of each other when accounting for shared physical/virtual servers, accounts, and network infrastructure. More critically, in 90% of countries, an attacker can achieve a monopoly attack -- capturing 50% or more of all NTP traffic for that country zone -- by adding 10 or fewer servers to the pool. The researchers validated this by actually carrying out the attack on Hungary's IPv6 zone, needing only two servers to capture roughly half the traffic. Given that NTP underpins certificate validation, DNSSEC, BGP security, and forensic logging, the potential downstream impact of time-shifting attacks through NTP pool monopolization is significant.

Background

▶ Watch: Key findings overview: only 20% of NTP servers are independent (0:00)

The Network Time Protocol (NTP) is one of the oldest core internet protocols, designed to distribute accurate time over packet-switched networks. Accurate time is a fundamental security building block: it is required for HTTPS certificate validation, DNSSEC, BGP security, and forensic logging. If an attacker can shift a client's clock, they can force acceptance of expired certificates, undermine cryptographic protocol security, or corrupt forensic timelines.

The NTP pool is a volunteer-based system where anyone can add an NTP server by registering a publicly reachable IP address. The pool uses DNS round-robin to direct clients to geographically close servers based on country zones. Operators can adjust a "net speed" knob to control how much traffic they receive. The pool monitors servers periodically to ensure they serve accurate time, keeping those with a score above 10.

The NTP pool has become critical internet infrastructure because countless low-cost embedded and IoT devices -- from Fritzbox routers to Amazon devices -- rely on it for time synchronization. The pool serves approximately 100,000 DNS resolutions per second globally. Prior work has studied NTP pool security through DNS-based server enumeration, but this approach is incomplete because servers with low traffic settings appear rarely in DNS responses, requiring millions of queries and still missing servers in the distribution tail.

Key Findings

▶ Watch: How the NTP pool works and why IoT devices depend on it (4:00)

Complete NTP pool enumeration via API reverse engineering. The researchers discovered that the NTP pool assigns sequential integer identifiers to servers starting at 1. By enumerating these IDs through reverse-engineered API endpoints, they achieved complete coverage of all ~65,000 servers ever registered in the pool's 23-year history. At the time of measurement, approximately 15,000-16,000 servers were active, of which only about 5,200-6,200 were serving good time.

30% of NTP pool addresses are not independent. After fingerprinting NTP servers by analyzing response fields (stratum number, NTP version, reference identifier), the researchers found that the 6,200 active addresses mapped to only 4,700 unique physical or virtual servers. Most clusters were dual-stack pairs (IPv4 and IPv6), but some consisted of a single server with five or more addresses -- meaning one server failure would remove multiple pool entries simultaneously.

Concentration risk in accounts and networks. While most operators add 10 or fewer servers, the distribution has a very long tail: some accounts operate hundreds of NTP servers. NTP pool servers are also heavily concentrated in a small number of ASNs, primarily cloud hosting providers like Vultr and Ionos, creating fate-sharing risk if a hosting provider experiences an outage.

Monopoly attack feasible in 90% of countries with 10 or fewer servers. Because only 25% of operators set their traffic knob to maximum, most zones have significant capacity headroom for an attacker who adds servers at maximum rate. In underserved countries like Hungary, only two servers at maximum rate were sufficient to capture 50% of NTP traffic.

10% server churn within one week. A non-trivial percentage of servers (approximately 10%) were active for only about a week before being removed, indicating instability in the volunteer base.

Technical Deep Dive

▶ Watch: NTP server fingerprinting and de-aliasing IP addresses (10:00)

The enumeration approach exploits the NTP pool's sequential server identifier scheme. When a new server is added to the pool, it receives the next integer ID. The researchers polled the API every few hours, checking for new IDs beyond the current maximum (~65,000), enabling them to detect new server additions in near-real-time. Additional API endpoints revealed the account that added each server, a capability not available through DNS-based enumeration.

The NTP server fingerprinting technique clusters IP addresses belonging to the same physical or virtual server. When multiple addresses in the NTP pool respond with identical stratum numbers, NTP version numbers, reference identifiers, and other protocol fields, they are likely served by the same NTP daemon on the same machine. This de-aliasing reduced the active server count from 6,200 to 4,700, revealing significant redundancy inflation in the pool's apparent server count.

The monopoly attack exploits the NTP pool's DNS round-robin weighting, which is proportional to each server's configured net speed. An attacker adds servers at the maximum speed setting and registers them in a target country zone. Because the pool distributes traffic based on relative weight, and most legitimate servers run at below-maximum speed, the attacker's servers receive a disproportionate share of DNS responses. The pool responds with four NTP server addresses per DNS query, and if the attacker's servers dominate the zone, multiple response slots may contain attacker-controlled addresses.

The researchers validated the attack against Hungary's IPv6 zone, adding two servers at maximum line rate and successfully capturing approximately 50% of NTP traffic. They emphasize that their servers provided accurate time -- they were demonstrating the feasibility of achieving traffic dominance, not actually conducting a time-shifting attack.

Demo / Proof of Concept

▶ Watch: Monopoly attack: 10 servers can capture 50% of a country's NTP traffic (12:00)

The researchers carried out a live (but benign) monopoly attack against the Hungary IPv6 NTP pool zone. By adding just two NTP servers configured at maximum net speed, they aggregated approximately 50% of the NTP traffic for that zone. The servers provided accurate time, so no clients were harmed. This practical validation confirmed the theoretical analysis that underserved country zones are highly vulnerable to traffic monopolization by small numbers of attacker-controlled servers.

Defensive Implications

▶ Watch: Q&A: monitoring system weaknesses and load balancing improvements (16:00)

The researchers shared their findings with the NTP pool operators and provided specific recommendations:

Limit per-account server additions. Restricting the number of servers any single account can add would raise the barrier for monopoly attacks, though the researchers acknowledge an attacker could create multiple accounts to circumvent this. Additional identity verification could help but would reduce the pool's open volunteer model.

Improve DNS response diversity. The pool currently returns four NTP servers per DNS response. If the pool's DNS logic ensured these four addresses belonged to different accounts, different ASNs, and different physical servers, it would significantly improve resilience to both monopoly attacks and cascading failures.

Monitor for anomalous server additions. The pool should detect sudden additions of many high-speed servers in underserved zones, which is the signature of a monopoly attack.

For enterprise defenders, the implications are clear: organizations that rely on the NTP pool for time synchronization (either directly or through embedded/IoT devices on their networks) face supply chain risk in their time infrastructure. Critical systems should use dedicated NTP sources (such as time.apple.com, time.windows.com, or internal GPS-disciplined NTP servers) rather than the public pool. Network monitoring should flag unexpected NTP server changes for critical infrastructure.

Key Takeaways

• The NTP pool serves ~100,000 DNS resolutions per second and is critical infrastructure for millions of IoT and embedded devices
• Only 20% of NTP pool servers are truly independent; 30% of addresses share physical/virtual servers, and many are concentrated in a few hosting ASNs
• In 90% of countries, an attacker can monopolize 50%+ of NTP traffic by adding just 10 or fewer servers at maximum speed
• The researchers validated the monopoly attack live on Hungary's IPv6 zone with only 2 servers
• Sequential server IDs and undocumented APIs allow complete pool enumeration without noisy DNS probing
• Only 25% of NTP server operators use maximum traffic settings, creating exploitable headroom for attackers
• Organizations relying on NTP pool for critical systems face unmanaged supply chain risk in their time infrastructure

About the Speaker(s)

Robert Beverly is at SDSU (San Diego State University). The talk was presented by Eric Rye, who conducted this work in collaboration with Beverly. Rye also runs the IPv6 Observatory project, where he operates IPv6 NTP servers and observes millions of devices (including Fritzbox routers and Amazon devices) querying for time. The researchers have strong expertise in internet measurement, protocol security, and infrastructure characterization.