Covert Message Channels and Attack Vectors for IEEE Precision Time Protocol

Abstract

The IEEE 1588 standard, known as Precision Time Protocol (PTP), is an emerging candidate for high precision timing and clock distribution networks. We present experimental results from a PTP test bed that demonstrate new types of covert channel communications, which allow PTP protocol to be used for data exfiltration and other network communication that violates the implemented cybersecurity policy. We then expand upon this work to demonstrate two new zero-day vulnerabilities in the PTP protocol, and develop proof-of-concept exploits for these attacks. In one attack, we demonstrate a novel man-in-the-middle (MITM) packet injection exploit against the PTP network that produces large, incorrect timing offsets at PTP timeReceiver nodes. In a second attack, we demonstrate the use of specific meta-data payloads to generate large time Transmitter (i.e. master clock) offsets, and to manipulate not just the clock offset but the actual clock frequency itself. We also investigate proposed mitigation techniques, including the use of NTS secured NTP with PTP concurrently which is suggested by some of our experimental results using Timemaster.