Hi! Is it possible to derive and/or estimate the system clock by observing TCP sequence numbers?
Jacob Appelbaum [1]: > In the Linux kernel, TCP Sequence numbers embed the system clock and then hash it. Yet another way to leak the system clock to the network. As I understand the paper 'An Improved Clock-skew Measurement Technique for Revealing Hidden Services' [2] (6/23 = pdf page 3), it implies that TCP sequence numbers can leak the system clock. > Some clocks can be queried remotely: > Clock: TCP sequence numbers > Firewall: Cannot be blocked > Other: Linux specific, very difficult to use Is this the case or does that paper mean something else? On the other hand, I've read the claim "The kernel embeds the system time in microseconds in TCP connections.", but I haven't found the code in question to confirm, that this is so. Any idea? Was also recently raised on Tor's issue tracker. [3] More resources: [4] [5] Cheers, Patrick [1] https://twitter.com/ioerror/status/509159304323416064 [2] http://caia.swin.edu.au/talks/CAIA-TALK-080728A.pdf [3] https://trac.torproject.org/projects/tor/ticket/16659 [4] http://lxr.free-electrons.com/source/net/ipv4/tcp_ipv4.c [5] http://stackoverflow.com/questions/12231623/initial-sequence-number-generation-in-linux-tcp-stack/12232126#12232126 _______________________________________________ Tails-dev mailing list Tails-dev@boum.org https://mailman.boum.org/listinfo/tails-dev To unsubscribe from this list, send an empty email to tails-dev-unsubscr...@boum.org.
