Dark Mode
Capec-295 Detail
Timestamp Request
Detailed Software Typical Severity: Low
Parents: 292
Threats: T60 T65 T80 T258 T273 T288 T291 T302 T334 T392 T407
This pattern of attack leverages standard requests to learn the exact time associated with a target system. An adversary may be able to use the timestamp returned from the target to attack time-based security algorithms, such as random number generators, or time-based authentication mechanisms.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-295 | capec | https://capec.mitre.org/data/definitions/295.html | |
| CWE-200 | cwe | http://cwe.mitre.org/data/definitions/200.html | |
| T1124 | ATTACK | https://attack.mitre.org/wiki/Technique/T1124 | System Time Discovery |
| REF-33 | reference_from_CAPEC | Stuart McClure, Joel Scambray, George Kurtz, Hacking Exposed: Network Security Secrets & Solutions (6th Edition), 2009, McGraw Hill | |
| REF-123 | reference_from_CAPEC | http://www.faqs.org/rfcs/rfc792.html | J. Postel, RFC792 - Internet Control Messaging Protocol, 1981--09, Defense Advanced Research Projects Agency (DARPA) |
| REF-124 | reference_from_CAPEC | http://www.faqs.org/rfcs/rfc1122.html | R. Braden, Ed., RFC1122 - Requirements for Internet Hosts - Communication Layers, 1989--10 |
| REF-125 | reference_from_CAPEC | http://nmap.org/docs/discovery.pdf | Mark Wolfgang, Host Discovery with Nmap, 2002--11 |
| REF-147 | reference_from_CAPEC | Gordon "Fyodor" Lyon, Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning (3rd "Zero Day" Edition), 2008, Insecure.com LLC, ISBN: 978-0-9799587-1-7 |
Not present
- The ability to send a timestamp request to a remote target and receive a response.
- Scanners or utilities that provide the ability to send custom ICMP queries.
Not present
| Confidentiality |
|---|
| Other |
- An adversary sends an ICMP type 13 Timestamp Request to determine the time as recorded by a remote target. Timestamp Replies, ICMP Type 14, usually return a value in Greenwich Mean Time. An adversary can attempt to use an ICMP Timestamp requests to 'ping' a remote system to see if is alive. Additionally, because these types of messages are rare they are easily spotted by intrusion detection systems, many ICMP scanning tools support IP spoofing to help conceal the origin of the actual request among a storm of similar ICMP messages. It is a common practice for border firewalls and gateways to be configured to block ingress ICMP type 13 and egress ICMP type 14 messages.
- An adversary may gather the system time or time zone from a local or remote system. This information may be gathered in a number of ways, such as with Net on Windows by performing net time \\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. The information could be useful for performing other techniques, such as executing a file with a Scheduled Task, or to discover locality information based on time zone to assist in victim targeting