The Network Time Protocol (NTP) has been in the news a number of times over the past couple of years because of attacks on the protocol, vulnerabilities in the daemon, and the use of NTP in DDoS attacks.

In each case, the developers of NTP have responded quickly with fixes or recommendations for remediating these attacks. Additionally, the development team has continued to look ahead and has worked to enhance the security of NTP.

Unfortunately, that has not translated to an improved security picture for NTP. Part of the problem with NTP is that it is a “set it and forget protocol.” When a new router or server is deployed NTP is configured and then most likely never touched again on that device. This often includes not upgrading the NTP daemon as new releases are available and it definitely does not include updating NTP configuration as new security recommendations are released. This means that there are a lot of vulnerable NTP clients and servers that are publicly accessible.

As a side project I run an NTP server that is part of the NTP Pool Project and is included in the pool.ntp.org rotation. I collect some statistical data from the incoming requests in order to understand more about how NTP traffic works from the server side. On August 1st, I collected 12 hours of NTP version data to see what the clients connecting to the server were running. I like the NTP Pool Project because it matches up random clients with servers that are part of the pool. This means that the server I manage sees a pretty random slice of traffic from around the world.

A little bit of background. NTP version 0 was first released with RFC 958 in 1985 (David L Mills actually developed it prior to that, but the release of the RFC is a good start date), more than 30 years ago. NTP version 3, documented in RFC 1305, was released by Mills in 1992. The most recent version of NTP, version 4, was released in 2010 and documented by Mills and team in RFC 5905. That means that the most recent version of NTP is more than 6 years old.

During the 12 hour period I was monitoring for incoming version information I saw a total of 4,597,036 incoming NTP requests. Of those 4,597,036 requests, 1,216,867 or 26.47% were NTP version 3 requests. Six years in, more than a quarter of NTP clients still have not upgraded to a version of the NTP daemon that supports version 4. Even in the small sample size that I was presented, 1,216,867 NTP clients have the potential to be used in a DDoS attack or are potentially exposing the rest of the network to attack.

All of the hard work being done by the NTP development team and researchers who are driving the improvements in NTP security doesn’t mean anything if the end users of the NTP protocol don’t focus on upgrading their systems and improving security practices around NTP.