< Previous by Date Date Index Next by Date >
  Thread Index Next in Thread >

[reSIProcate] Timer vulnerability


We are experiencing users hacking our client software on windows. They do so by manipulating windows system time. Which causes timers to be fired prematurely and incur undesired behavior in the stack.

As a counter to these hacks, I plan to change Timer::getSystemTime() to use GetTickCount() instead of GetSystemTime() for windows. The drawbacks are: 1. The value returned would have less precision. From 1/million second to 1/thousand second, but remain the same unit (1/million second). Which should not be a big deal, at least on Windows anyhow. 2. The value returned would not be associated to calendar time anymore. This worries me somewhat, I am not sure if anyone uses this function in such a way.

Ken