NTP Vandalism - An open letter.

[jadeclaw]

The problem: Many routers keep their internal clock by querying a time-server on the internet. However, instead of operating their own server, the router manufacturers rely on a list of publicly available servers. And that's, where this amounts to vandalism, because very often, access rules are ignored and violated. The latest victim is a privately operated server in Denmark, whose owner now faces a yearly $8000 bill, plus a host of extra cost, thanks to D-Link. Since D-Link refuses to pay for the damages their equipment causes, the time server operator decided to go public:

http://people.freebsd.org/~phk/dlink/

By the way, we had seen this before:

http://www.cs.wisc.edu/~plonka/netgear-sntp/

Atleast, Netgear was more cooperative. Much more cooperative, I have to add. (See inside link below)

EDIT: Link fixed.

UPDATE: Poul added a link to the expert, who tracked down the problem.

I include that here as well, as it describes clearly the size and scope of the problem:

When Firmware Attacks! (DDoS by D-Link).

Edited April 8, 2006 by jadeclaw

[streaml1ne]

I'd also be willing to bet that the D-link device is using at least SOME code from *BSD sources which adds irony to the situation.

[atrain]

so the $8000 bill is the router pinging the time server? getting a data packet for world time?

[Stuge]

I also have D-Link Router ..Yeah I do find my modem Link/Act blinking even my computer is off that`s why now i keep my modem off whenever my PC is not in use .

Edited April 8, 2006 by stuge

[jadeclaw]

so the $8000 bill is the router pinging the time server? getting a data packet for world time?

Correct, but not one, hundred thousands of them. And going through the list of included servers, only servers of public organisations and educational facilities had been included. Since most people still use MS-Windows, I would have expected to find 'time.windows.com' in there. That one can handle the traffic easily and Microsoft possibly wouldn't even notice, expecting tons of traffic from their OS-installs. But no, it is better to vandalize public property and violate access rules. *GRMPF*

Advice: If your D-Link-Product allows to enter a specific time server, either set it to time.windows.com or use the NTP-pool for that.

http://www.pool.ntp.org/.

That way, the traffic load is distributed evenly onto many shoulders.

And of course, check out, if your ISP offers a time server, then use that in the first place.

Edited April 8, 2006 by jadeclaw

[atrain]

sorry typo i meant routers

thanks for the clarification

my router hits

time.windows.com

[jadeclaw]

UPDate: Obviously public pressure works.

2006-04-27 Update:

"D-Link and Poul-Henning Kamp announced today that they have amicably

resolved their dispute regarding access to Mr. Kamp's GPS.Dix.dk

NTP Time Server site. D-Link's existing products will have

authorized access to Mr. Kamp's server, but all new D-Link

products will not use the GPS.Dix.dk NTP time server. D-Link is

dedicated to remaining a good corporate and network citizen."

Let's hope, other hardware makers learn from this and avoid making the same mistake in the future.