Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Excessive load on NTP servers

news.ntppool.org

Post reply on HN
Print view View original

1–10 of 157 posts

Re: Excessive load on NTP servers

#2

Post by easytiger »

Wait.. they are saying the app itself is making NTP requests?

> Confirmed - starting up the iOS Snapchat app does a lookup to the domains you listed, and then sends NTP to every unique IP. Around 35-60 different IPs.

Hmm. Is that a fraud prevention thing or something? No way on earth a user app should be getting its own time

Re: Excessive load on NTP servers

#3

Post by nkcmr »

easytiger wrote: post #2

Wait.. they are saying the app itself is making NTP requests? > Confirmed - starting up the iOS Snapchat app does a lookup to the domains you listed, and then sends NTP to every unique IP. Around 35-60 different IPs. Hmm. Is that a fraud prevention thing or something? No way on earth a user app should be getting its own time

The report does say "app" specifically. So I assume yes.

Re: Excessive load on NTP servers

#6

Post by AlphaWeaver »

gbrown_ wrote: post #5

For all of Apple's App Store vetting one would think this kind of behavior would have thrown up a flag at some point no?

App Store vetting varies wildly and tends to trend towards more close introspection on smaller apps. Well known apps such as Facebook Messenger and Snapchat for example can get an update reviewed and pushed out faster than a standalone developer.

Re: Excessive load on NTP servers

#7

Post by pooper »

AlphaWeaver wrote: post #6
gbrown_ wrote: post #5

For all of Apple's App Store vetting one would think this kind of behavior would have thrown up a flag at some point no?

App Store vetting varies wildly and tends to trend towards more close introspection on smaller apps. Well known apps such as Facebook Messenger and Snapchat for example can get an update reviewed and pushed out faster than a standalone developer.

I think Apple should require app vendors to just submit source code and build instructions and have Apple just build it.

It'd be harder to pull off on Google Play Store but I think Apple could make this happen if they wanted to.

Re: Excessive load on NTP servers

#8

Post by acqq »

According to the forum, the pattern matched this third-party library:

https://github.com/jbenet/ios-ntp

Specifically, all the servers(!) from here are contacted: https://github.com/jbenet/ios-ntp/blob/master/ios-ntp-lib/Ne...

Note that the library author wrote:

"ios-ntp is often (mostly?) used to make sure someone hasn't fiddled with the system clock. The complications involved in using multiple servers and averaging time offsets is overkill for this purpose. The following skeleton code is all that is needed to check the time."

And that "skeleton" contacts just "time.apple.com"

But the library really has the default possibility of contacting a lot of the ntp.org servers from a big list ("createAssociations" with no parameters!) and it's bad.

As we know, the developers like to just "copy-paste" whatever is where. Or use any defaults. "Hey it works."

Re: Excessive load on NTP servers

#9

Post by acqq »

easytiger wrote: post #2

Wait.. they are saying the app itself is making NTP requests? > Confirmed - starting up the iOS Snapchat app does a lookup to the domains you listed, and then sends NTP to every unique IP. Around 35-60 different IPs. Hmm. Is that a fraud prevention thing or something? No way on earth a user app should be getting its own time

> Is that a fraud prevention thing or something?

See my other post here, and the problems in the (third party) iOS NTP library "features" and its use.

There "createAssociations" in that library without any parameters contacts all the IPs behind the big domain list of the NTP servers!

And according to the forum every IP is contacted -- behind one server name there are 3-4 servers in the DNS in this case, I get 31 server! Real "distributed denial of service" attack.

Post reply on HN