When hackers control the clock.

0:00You're listening to the CyberWire Network, powered by N2K. Maybe that's an urgent email from your CEO, or maybe it's a deepfake targeting your business. Doppel is the AI native social engineering defense platform, fighting back against impersonation and manipulation. As attackers use AI to make their tactics more sophisticated, Doppel uses it to fight back, automatically dismantling cross-channel attacks, building team resilience and providing agentic email protection. Doppel, outtacing what's next in social engineering. Learn more at Doppel.com. That's D-O-P-P-E-L-D-D-D-C-O. At a really high level, times probably the most trusted input in computing and one of the least defended.

1:07So everyone assumes that time is correct, and that all other inputs into software, systems, control flows may potentially be be tampered with and therefore have to be validated in some way. And often people don't realise that time A can be manipulated and if it is, that it's time that's being manipulated that's resulting in the behaviour that they're seeing in either their software or systems. Welcome, I'm Marie Overmosis and you're listening to T-Mine of Space Cyber Briefing. In this show, we examine the evolution of cybersecurity in the global and orbital infrastructure that powers, protects and connects our lives.

2:07Hi everyone, thank you as always for joining me. Consider the following. A threat actor doing dastardly things to a key dependency, a single source of truth that basically all of modern computing and infrastructure runs on. Now lots of you listening undoubtedly don't have to imagine it. All I need to say is heartbleed and I can hear a bunch of you groaning right back at me. Sorry for that unpleasant reminder. But for today's chat, we are not going to look at TLS, don't worry. Instead we're going to look at time. And this is a space cyber show. So when we talk about time, I mean the kind of thing that you get from positioning navigation and timing satellites like GPS. So if you need a brush up on all things GPS, I highly recommend you first take a listen to our two part GPS explainer if you haven't yet. Those would be episodes 709 and 710 and don't worry links are in the show notes for you.

3:16Now a concept that we touched on in the second episode was how positioning and navigation exploits of GPS signals are better known and appreciated. But the timing part of it is both much more important and much less understood than it should be. So in today's episode, we're going to dig into that in depth with Andy Davis, Global Research Director at NCC Group. In my discussion with him today, he posits that yes, time is one of the most trusted yet least defended inputs in computing and that manipulating it can create significant security and reliability impacts. The kinds of operational risks introduced by monkeying with time. It is not sci fi. It's very real. So let's get into it. Hi, I'm Andy Davis. I'm a global research director at NCC Group, which is a pure play sob security consulting firm.

4:19I've been at NCC for around 15 years, about half of that time doing research and half of it running our transport practice that connected cars, playing strings, that kind of thing. I've been in this industry for more than 30 years now, really interested in understanding how things work and how I can get things to working ways that they were designed. I love that. That is what I think a lot of us got into cyber security for is how do we make it do that thing? Yeah, Andy, thank you so much for joining me today. You and your team got in touch about a really fascinating piece that you wrote and let's start with maybe what that thesis is and then we'll get into the details. Sure, well, at a really high level times, probably the most trusted input in computing and one of the least defended. So everyone assumes that time is correct and that all other inputs into software systems, control flows may potentially be tampered with and therefore have to be validated in some way.

5:31And the premise of the paper is that there are many different ways of manipulating time. Time should be considered another input that can be manipulated and you can have all kinds of interesting impact and controls over systems by manipulating the time that's provided to them. And often people don't realize that time a can be manipulated. And if it is that it's time that's being manipulated that's resulting in the behavior that they're seeing in either the software or systems. Oh, okay, I want to dive into all of that. So let's let's start first with timing. You said there is a bunch of different ways that that can essentially be an input. What, what are those ways? So if you've got a large collection of computers, augmented together in data center, let's say, often you will have a central source of truth, the time quite often GPS is used the global positioning system.

6:35So I'm going to talk about the GPS satellite and on all GPS satellites, they have a very accurate time source, a clock that's based on a nuclear reaction that's very, very precise. Timing is incredibly important in the GPS satellite network because if you didn't have such accurate time that GPS wouldn't work, the subtle differences in the signals being sent from the different GPS satellites, if they weren't that accurate, your location wouldn't be able to be determined as accurately as it can. So people use the fact that GPS satellites are accessible from everywhere on Earth, and by pointing in on center at the sky, you can get the current accurate time. So they tend to use that as the kind of single source of truth for a computer network and synchronize via various network timing protocols, all the different computers and software that's running on them to that single source.

7:41Because it's a radio signal, you may well have heard in military context sometimes adversaries will block the GPS signal to prevent people, you know, accurately knowing where they are, but you can be more creative than that. You can actually spoof GPS signals. So if I had a software, a farm radio, which is a piece of kit that you can buy for less than a $5,000, probably significantly less than a $5,000 and pointed my antenna at the receiving antenna on the roof of a data center, I could pretend to be the GPS software network. I could inject my own time that could be certainly different or wildly different to the real time. And of course, because all of the computers are trusting that time signal, that information would get propagated and reflected through the network.

8:41And so that's a kind of a central place where time could be manipulated. But as I said, the where the information is propagated from one computer to another using a network time protocol. So if somebody has got some kind of level of access to that network and has the ability to spoof their own network time protocol or inject protocol data into that network, they can manipulate the time on the network itself. Now that's not quite so satisfactory because if you if you're not manipulating the original kind of source of truth coming from a satellite, it might continue to kind of override any changes you try and make within the network. Right. So there are two kind of ways where people can manipulate that time. Another place just quickly to think about is as a computing infrastructure is becoming more and more virtualized.

9:42So instead of lots of physical computers, you've got lots of computers that are running hypervisors that are running virtual computers inside of them. So if you look at the layer of virtualization you've got within computing, it's essentially its own little universe that can run its own. Yes, it's own time. So, you know, if you can manipulate how time is propagated to these different virtual worlds where virtual computers are running on, then it's another way of manipulating their understanding of what the current time is. Yeah, and that's really the question that comes up for me is I think in the very abstract, I have a little bit of a sense of, you know, you start manipulating time bad things will happen. What does happen if you mess with timing because I just such a very, very basic layer of understanding that everything operates on. So is it just things don't work correctly or things just don't work or does it depend. There are some very targeted attacks that you can do, expiry of things like security certificates is a great example.

10:48I mean, just to make it kind of really simple to understand if you imagine a cinema ticket that expires at midnight tonight, the ticket itself, maybe genuine. But if somebody changes the clock that checks the ticket, then yesterday's tickets suddenly becomes valid again. And instead of a cinema ticket, it's a security certificate that's providing one system access to another system. And, you know, somebody's decided that on a certain date that expires and should be revoked or should be reset for whatever reason, that that's an example of where access control could be bypassed. Well, time is on our side, time is the enemy, one thing's for sure, time is, and it is time for us to take a quick break. We'll be right back.

11:52Today's cyber criminals aren't just launching attacks, they're building businesses around them. They have subscription models, they have a marketplace, they have affiliate program. If you want to do referrals, you can get credits. They make it really easy, it really looks like a legitimate SaaS product that somebody might use. I sat down with Mike Britton, CIO at Abnormal AI, to explore how AI is lowering the barrier to cybercrime and what security leaders need to change in response. Here are full conversation at explore.theciberwire.com slash Abnormal AI. We return now to my discussion with Andy Davis, Global Research Director at NCC Group, about why timing is a crucial but under appreciated dependency in modern computing.

12:58My next question to him was on the manipulation of timing in attacks against crucial infrastructure like power grids. What would those kinds of attacks look like? Synchronization of systems is often very important and the way that power generation systems operate sometimes rely on very accurate synchronization between one system and another. If you can desynchronize those, you can have a massive impact on the way that the system operates and can negatively impact the generation of the power. Or could potentially cause outages or even fires and really nasty events. If systems go out of synchronization that are controlling safety critical elements, critically after infrastructure. Yeah, I think it's something I really didn't appreciate at all and I'm still, as I've said, I'm learning so much about this.

14:00I guess what do we do from here? How do we make systems more resilient? Perhaps incorrectly had assumed there was a lot of redundancy to protect from this sort of thing or perhaps that these kinds of risks were so maybe military focus that perhaps the rest of us don't need to worry about this as much. But it sounds like those are false assumptions. So with regard to redundancy, people think about the redundancy of their systems rather than necessarily the redundancy of their alternate time sources. When people think about time, they're normally more concerned about how accurate that time is rather than being concerned about what happens if that time is wrong. So it's kind of a shift in mindset really that we're talking about from an accuracy mindset to an integrity mindset. Because Dictal.dert often think about the fact that time could be wrong. And if it was wrong, what impact it might have on their systems.

15:02It's all about having multiple time sources that you can compare against. So for example, you know, I talked about accurate time sources being on board satellites in the situation where you've got a large data center with lots of expensive servers in it. It's not that much more expensive together after a time source, you know, independent of the satellite network that you have within your network. So, you know, one of those seizing clock stuff kind of thing, the kind of thing that's actually based on all the satellites. So you can have multiple time sources and constantly compare between the two and make sure that one isn't being manipulated. But if you look at mobile phones, for example, one of the things that they do in this sense is they're constantly getting the accurate time information from the GPS satellites because all smartphones these days have got GPS in them. But they also have accurate time source that sent via the cellular network.

16:03And therefore they are able to cross reference between those two. And if, if for example, they suddenly see that the GPS time source changes, they can see that either there's been a problem, you know, some kind of reception problem or it's being spoofed or manipulated. All right. So for an InfoSec practitioner who's listening to our chat right now, I'm wondering if there's anything any base assumption that we should be challenging or anything that might surprise them to learn that that you want to highlight. I think that the most surprising thing is that when time is either manipulated or that the or straights, you know, it changes as a result of some kind of non malicious reason, the way that that can be exhibited in behavior and systems doesn't immediately make you think that something external is affecting it.

17:07People wouldn't necessarily jump to the conclusion that it's time that's caused this because, you know, apart from the targeted type attacks that talk about where you meet that time and bypass the security control. If time drifts, it can have very subtle effects on control systems that's saying and they could be seen as an intermittent failure, or they could be seen as maybe a component within the system that's just degraded over time. The way that it's behaving so people might jump to the conclusion that all that that system might have failed and that's why it's behaving that way rather than the time source that it's relying on has strayed or stopped or changed and that's that's the result. Again, it's a kind of a mindset of don't assume that when you see a normalist behavior in your systems, so it's actually the fault of the system, it might be.

18:16You know, the time source that's being provided to it that can have those effects. I just like to mention an incident that happened back in 2012 called the leap second incident now a leap second is an extra second that occasionally needs to be added to universal coordinated time UTC. It in a coordinated way globally because of the way that the earth rotation changes over time compared to our universal science is basically a correcting factor that every number of years they need to add an extra second, which is called a leap second. And back in 2012 when they inserted this leap second, it had a huge amount of effect on major internet services people like LinkedIn,

19:41and I was going to say I'm trying to remember that as well and I'm struggling. Can you refresh my memory a little bit on that one. So I mean, the kind of experiences that the servers had were CPU spikes, lockups, crashes, service, outages, because the different ways that software components within them handle the extra second in correctly. So that basically goes back to your question earlier about how should system designers cater for these things that they need to consider time being either actively manipulated or drifting as an input that needs to be checked and ensure that the road busness of their system when time does change. That's fascinating. I honestly, this has been such a really interesting chat and thank you so much for sharing your expertise with us today. It feels kind of metaphysical to be talking about time and such an abstract and also concrete with the same time. So this is super neat. And thank you so much for joining me today. I really appreciate it.

20:49I'm a customer. And that is T-Mine is Space Cyber Briefing brought to you by N2K CyberWire. If you like what you heard today, you will also enjoy our newsletter, Signals in Space. You'll get research and notes pulled together by our producer Ethan Cook and me along with this week's top Space Cyber News stories. Subscribe by visiting the cyberwire.com slash newsletters. We'd love to know what you think of our podcast. Your feedback ensures we deliver the insights that keep you a step ahead and the rapidly changing cyber security landscape. If you like our show and we always hope that you do, please share a rating and review in your podcast app. You could also fill out the survey in the show notes or send an email to us at space at N2K.com. We're proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector,

21:49from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K helps cybersecurity professionals grow, learn, and stay informed. As the nexus for discovery and connection, we bring you the people, the technology, and the ideas shaping the future of secure innovation. Learn how at n2k.com. Thank you again for listening to T-Minus. I am your host, Maria Varmazis. The show is produced by Ethan Cook and Liz Stokes. We're mixed by Elliott Peltzmann and Tre Hester, with original music by Elliott Peltzmann. Our executive producer is Jennifer Iben, with content strategy by Mayon Plought. Peter Kielpia's Our publisher. See you next week. T-Minus.