[reSIProcate] Timer vulnerability

Kenneth Ho kenho at bluebottle.com
Mon Apr 4 01:16:17 CDT 2005


We are experiencing users hacking our client software on windows. They 
do so by manipulating windows system time. Which causes timers to be 
fired prematurely and incur undesired behavior in the stack.

As a counter to these hacks, I plan to change Timer::getSystemTime() to 
use GetTickCount() instead of GetSystemTime() for windows. The drawbacks 
are:
1. The value returned would have less precision. From 1/million second 
to 1/thousand second, but remain the same unit (1/million second). Which 
should not be a big deal, at least on Windows anyhow.
2. The value returned would not be associated to calendar time anymore. 
This worries me somewhat, I am not sure if anyone uses this function in 
such a way.

Ken





More information about the resiprocate-devel mailing list