[reSIProcate] Timer vulnerability
Kenneth Ho
kenho at bluebottle.com
Mon Apr 4 01:16:17 CDT 2005
We are experiencing users hacking our client software on windows. They
do so by manipulating windows system time. Which causes timers to be
fired prematurely and incur undesired behavior in the stack.
As a counter to these hacks, I plan to change Timer::getSystemTime() to
use GetTickCount() instead of GetSystemTime() for windows. The drawbacks
are:
1. The value returned would have less precision. From 1/million second
to 1/thousand second, but remain the same unit (1/million second). Which
should not be a big deal, at least on Windows anyhow.
2. The value returned would not be associated to calendar time anymore.
This worries me somewhat, I am not sure if anyone uses this function in
such a way.
Ken
More information about the resiprocate-devel
mailing list