ICMP (Internet Control Message Protocol) timestamp scanning is a technique used to infer the system uptime of a target machine by analyzing its responses to specific network requests. Here's how it works:
Understanding ICMP Timestamp Messages
ICMP includes message types 13 (Timestamp Request) and 14 (Timestamp Reply). When a system receives an ICMP Timestamp Request, it responds with a Timestamp Reply containing three fields:
-
Originate Timestamp: The time the request was sent by the requester.
-
Receive Timestamp: The time the request was received by the target.
-
Transmit Timestamp: The time the reply was sent by the target.
These timestamps are typically measured in milliseconds since midnight UTC.
How Attackers Infer System Uptime?
By sending an ICMP Timestamp Request to a target system and analyzing the Timestamp Reply, an attacker can determine the system's current time. If the system's clock hasn't been manually set or synchronized with a time server, the current time can indicate how long the system has been running since its last boot.
Example:
-
An attacker sends an ICMP Timestamp Request to a target.
-
The target responds with a Timestamp Reply indicating it has been running for 7.5 hours since midnight UTC.
-
The attacker deduces that the system has been up for approximately 7.5 hours.
Security Implications
While this method may seem benign, it has several security implications:
-
Reconnaissance: Attackers can use system uptime information to identify potential targets and plan attacks during periods of low activity.
-
Time-Based Attacks: Knowing the system time can aid in attacks that rely on time synchronization, such as replay attacks.
-
Information Disclosure: Revealing system uptime can provide insights into system maintenance schedules and potential vulnerabilities.
Mitigation Strategies
To protect against information disclosure via ICMP Timestamp Replies:
-
Firewall Configuration: Block ICMP Timestamp Requests (Type 13) and Replies (Type 14) at the network perimeter.
-
System Configuration: Disable ICMP Timestamp responses on individual systems.
-
Regular Updates: Ensure systems are regularly updated and synchronized with trusted time sources to minimize discrepancies.
ICMP Timestamp scanning can inadvertently expose system uptime information, aiding attackers in reconnaissance and planning. By understanding this vulnerability and implementing appropriate mitigation strategies, organizations can enhance their security posture and reduce potential attack vectors.
