Windows feature that resets system clocks based on random data is wreaking havoc
1–10 of 169 posts
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#2The article doesn’t talk about a fix—scary. I know OpenBSD uses a similar SSL-based method for time keeping on startup, but I’ve never experienced an issue like this.
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#3TL:DR, the w32time service will sometimes try to bootstrap the clock with data from TLS handshakes. TLS 1.0-1.2 use a random value in Client Hello/Server Hello which was originaly specified as a uint32 gmt_unix_time plus 28 random bytes. It's better [1] to fill the whole structure with 32 bytes of random data (and TLS 1.3 specifies it without reference to time). If you interpret the random data as a unix time, sometimes you're going to get weird results. It's not clear to me what servers w32time probes to get these values, either.
I've seen other services that use https to bootstrap time in case other clocks are unavailable or suspect (or use a limited expiration certificate to authenticate!), it's a bit difficult because you have to ignore or postpone checking certificate expiration when validating the x.509 certificates, parse the http date header, and then presumably check that the date provided is within the time the certificates involved are valid.
[1] https://datatracker.ietf.org/doc/html/draft-mathewson-no-gmt...
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#4I sometimes experience a similar issue with my linux laptop where time jumps to the year 2077 when waking up from sleep. My guess is that it is a hardware glitch as it doesn't happen often, but when it does it is quite impactful.
One of the annoying consequences is that some parts of the system decide to clean up "old" data. Surely data that has been stale for 50 years can be deleted, right? I cannot imagine the impact of something similar happening on a production server.
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#5The article doesn’t talk about a fix—scary. I know OpenBSD uses a similar SSL-based method for time keeping on startup, but I’ve never experienced an issue like this.
Openbsd does an https (with expiry checks disabled) GET to google.com (or another server) and uses the Date header in the response.
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#6Blows my mind that anyone would use Windows on a server.
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#7I can't imagine the sequence of horrible decisions that led to doing this. Like, why would the time service ever want to depend on all this insanity when if it has a network and everything else is bizarro world, just like scrape the time and date text from weather.gov.
Or just accept that absent NTP, w32time maybe just shouldn't try to set the clock to whatever a circus clown tells it?
This sort of reminds me how there is a buried registry setting to tell w32time to not place the firmware clock at very high stratum in the time sources list which also is just a giant WTF in how those two behaviors were decided on.
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#8Wow, we encountered a similar problem on one of our servers. We couldn't determine the cause. We set up an alarm to notify us when such a change occurs, and we've developed a procedure to handle the consequences. Great discovery!
Re: Windows feature that resets system clocks based on random data is wreaking havoc
#9Blows my mind that anyone would use Windows on a server.
Even worse, some use Linux as their desktop OS. Imagine that...