Skip to main content

Traceability loss - Server's clock

Need​

Ensure accurate time synchronization for the server's internal clock

Context​

  • Usage of Python 3 for developing applications and scripts
  • Usage of datetime for working with date and time in Node.js applications

Description​

Non compliant code​

import datetime

def get_server_time():
    return datetime.datetime.now()

The function get_server_time() returns the current date and time according to the server's internal clock. This code is vulnerable because it does not sync the server's clock with a reliable external source, such as an NTP (Network Time Protocol) server.

If the server's internal clock is off, it could cause issues with time-sensitive operations. For example, if the server's clock is ahead, it could cause something to happen before it's supposed to. If it's behind, something could happen later than it's supposed to.

This vulnerability can be exploited in a number of ways. For instance, an attacker might be able to manipulate the server's clock to cause confusion or to exploit time-based functionalities in the system.

To fix this issue, the server's clock should be synced with an NTP server. NTP servers are designed to provide accurate and synchronized time across the network.

The Python ntplib library provides an easy way to interact with NTP servers. By using this library, we can ensure that our server's clock is always synced with the correct time.

Steps​

  • Install an NTP client on the server if it's not already installed.
  • Configure the NTP client to sync with a reliable NTP server. This could be a public NTP server or a private one depending on the organization's policy.
  • Set the NTP client to automatically start on system boot so that the server's clock is always synced.
  • Modify the 'get_server_time' function to get the time from the NTP client instead of using the system's internal clock. This ensures that the time returned is always synced with the NTP server.
  • Test the changes to ensure that the server's time is now correctly synced with the NTP server and that the 'get_server_time' function returns the correct time.

Compliant code​

import ntplib
from time import ctime

def get_server_time():
    c = ntplib.NTPClient()
    response = c.request('pool.ntp.org')
    return ctime(response.tx_time)

The original code was vulnerable because it was using the system's internal clock to get the current time. If the system's clock was not synced with an NTP server, this could lead to traceability loss.

The fixed code uses the ntplib library to get the current time from an NTP server. This ensures that the time returned by the get_server_time function is always synced with the NTP server.

The NTP client is also configured to start automatically on system boot, ensuring that the server's clock is always synced.

Finally, the changes should be tested to ensure that the server's time is now correctly synced with the NTP server and that the get_server_time function returns the correct time.

References​

Last updated on