ICMP Timestamp Request
Attack Pattern ID: 295 (Detailed Attack Pattern Completeness: Stub)Typical Severity: LowStatus: Draft
+ Description

Summary

An attacker sends an ICMP type 13 Timestamp Request to determine the time as recorded by a remote target. Timestamp Replies, ICMP Type 14, usually return a value in Greenwich Mean Time. An attacker can attempt to use an ICMP Timestamp requests to 'ping' a remote system to see if is alive. An attacker may be able to use the timestamp returned from the target to attack time-based security algorithms, such as random number generators, or time-based authentication mechanisms. Additionally, because these types of messages are rare they are easily spotted by intrusion detection systems. Many ICMP scanning tools support IP spoofing to help conceal the origin of the actual request among a storm of similar ICMP messages. It is a common practice for border firewalls and gateways to be configured to block ingress ICMP type 13 and egress ICMP type 14 messages.

+ Target Attack Surface

Target Attack Surface Description

Targeted OSI Layers: Network Layer

Target Attack Surface Localities

Server-side

Target Attack Surface Types: Network Host

+ Attack Prerequisites

The ability to send an ICMP type 13 query (Timestamp Request) to a remote target and receive an ICMP type 14 message (Timestamp Reply) in response.

+ Resources Required

The ability to send custom ICMP queries. This can be accomplished via the use of various scanners or utilities.

+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern292Host Discovery 
Mechanism of Attack1000
+ References
Stuart McClure, Joel Scambray, George Kurtz. "Hacking Exposed: Network Security Secrets & Solutions". 6th Edition. McGraw Hill, ISBN: 978-0-07-161374-3. 2009.
J. Postel. "RFC792 - Internet Control Messaging Protocol". 1981. <http://www.faqs.org/rfcs/rfc792.html>.
Internet Engineering Task Force, R Braiden, Editor. "RFC1122 - Requirements for Internet Hosts - Communication Layers". 1989. <http://www.faqs.org/rfcs/rfc1122.html>.
Mark Wolfgang. "Host Discovery with Nmap". 2002. <http://nmap.org/docs/discovery.pdf>.
Gordon "Fyordor" Lyon. "Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning". 3rd "Zero Day" Edition. Insecure.com LLC, ISBN: 978-0-9799587-1-7. 2008.
Back to top