Since PTP operates by exchanging timing messages, certain risks may arise in this process. If
a message is deliberately modified by a third party, or if unwanted incorrect messages are
generated, a PTP network may fail to maintain its accuracy. It is crucial to remain vigilant
against such attacks to prevent our digital devices from falling prey to them. In the
following section, we will introduce some common PTP attacks and share tips on how to avoid
them.
PTP attack types
A simple way to classify PTP attack types is to separate them into internal ones and external
ones.
Internal PTP attack
As for internal PTP attacks, attackers can be classified into two levels based on their
abilities and their access to a device.
Simple attacks
This level of attackers operates within a trusted network, either through a secretly-added
untrusted device or a legitimate trusted device, but WITHOUT having access to cryptographic
keys. Some attacking movements at this level include packet removal, packet delaying, traffic
generation and Denial of Service (DoS) attacks.
Advanced attacks
The advanced attackers, who gain FULL access to a device, including access to
encryption/authentication keys through malware infection or manipulated firmware upgrades, are
capable of controlling the device's behavior or configuration. They can alter clock properties
or manipulate packet content in transit to deceive the BMCA and disrupt the time exchange
process. Additionally, they have the capability to generate new legitimate-looking packets to
disrupt accurate time alignment.
External PTP attacks
External PTP attackers operate from outside the trusted network and do not have access to
secret network encryption or authentication keys. These attackers may attempt to disrupt the
time synchronization process by exploiting vulnerabilities of devices or connections in the
network. Their lack of access to cryptographic keys does not hinder their ability to target
the network, as they employ various techniques to intercept, generate or modify PTP packets,
thus disrupting time synchronization process.
PTP attacker types
Man-in-the-middle attacker
A man-in-the-middle attacker focuses on intercepting and manipulating messages within a PTP
network. This attacker can intercept and modify PTP packets while they are in transit. They
typically achieve this by gaining physical access to a node within the network or by gaining
full control of a device within the network.
Packet injector attacker
A packet injector attacker disrupts the time exchange system by flooding the network with
excessive network traffic. Despite having limited attack capabilities in an untrusted network,
it can still render a PTP network out of function by overwhelming it with a high volume of
packets, causing congestion and hindering the synchronization process.
Attacking scenario
Below is an interactive computer network where you can experiment with adding various
attackers to examine their abilities to disrupt the network.
Choose an attack type to observe its execution
How can we ensure our safety
While cybersecurity in PTP or computer networks is primarily the responsibility of software
engineers, there are steps we can take to protect ourselves. Installing a firewall, exercising
caution with suspicious emails or links, and avoiding visiting abnormal websites are all
measures that can help prevent potential invasions by PTP attackers. By taking these
precautions, we can safeguard ourselves and lower the risk of financial loss, especially when
engaging in activities such as stock speculation. Ultimately, these measures allow us to fully
enjoy the convenience brought by 5G technology!
