Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Behind the Random NTP Bizarreness of Incorrect Year Being Set - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Behind the Random NTP Bizarreness of Incorrect Year Being Set

A few people have written in within the past 18 hours about their NTP server/clients getting set to the year 2000.  The cause of this behavior is that an NTP server at the US Naval Observatory (pretty much the authoritative time source in the US) was rebooted and somehow reverted to the year 2000.  This, then, propogated out for a limited time and downstream time sources also got this value.  It's a transient problem and should already be rectified.  Not much really to report except an error at the top of the food chain causing problems to the layers below.  If you have a problem, just fix the year or resync your NTP server.

Just goes to show how reliant NTP is that it is all but a "fire and forget" service once configured until "bad things happen".  

John Bambenek
bambenek \at\ gmail /dot/ com
Bambenek Consulting


262 Posts
ISC Handler
Nov 20th 2012
It's a biproduct of the Mayan Calendar thing, I just know it.

Thanks for update. Maybe powered off and a $2 CMOS battery long since been dead.

3 Posts
The biggest Y2K glitch happens nearly 13 years after the fact. It is a true testament to the foresight of the alarmists of the last century.
1 Posts
FWIW, If you were running D4 for Windows,
D4 would have asked do you really want to change your time by -8xxx days, 0 hours, 0 minutes, and 0 seconds.

1 Posts
This is why having a CDMA time server or other primary source is a good thing.

6 Posts

Sign Up for Free or Log In to start participating in the conversation!