  Network Time Protocol (NTP) is used by millions of hosts in Internet today to
synchronize their clocks. Clock synchronization is necessary for many network
applications to function correctly. Unsynchronized clock may lead to failure of
various core Internet services including DNS and RPKI based interdomain routing
and opens path for more sophisticated attacks. In this paper, we describe a new
attack which can prevent a client configured in NTP's broadcast mode from
synchronizing its clock with the server. We test the attack in real networks
and show that it is effective in both authenticated and unauthenticated
broadcast/multicast modes of NTP. We also perform experiments to measure the
overall attack surface by scanning the entire IPv4 address space and show that
NTP broadcast mode is being used in the wild by several low stratum (highly
accurate) hosts. We also suggest few countermeasures to mitigate the proposed
attack.
