The Network Time Protocol (NTP) is the primary synchronization protocol for billions of devices. Although attacks on NTP servers have been well studied, attacks on NTP clients are less well understood. In this thesis, we scrutinize the 8 NTP clients across 3 Operating systems and test their resilience against attackers and malicious public time servers. We test all the clients against time manipulation, or time-shift attacks and exploit NTP protocol features to induce a denial-of-service for the client by cutting them off from legitimate time servers. We also analyze how these clients perform in normal operations or do they deviate from the NTP-specification-recommended behavior.

Our research analysis unveils 5 bugs and one vulnerabilities, which we disclose to the vendors. While most of the NTP clients follow the associated NTP standards, there exists a wide diversity in the behavior of all the time clients. While many clients follow the specification and best practices, deviations exist which make some of our attacks successful. In detail, macOS time client
is vulnerable to Time Shift attacks, and NTPD-RS is vulnerable to certain Kiss-of-Death packets which causes it to flood the network with queries and OpenNTPd cannot handle the NTP timestamp rollover. We dive into the design and configuration decisions that make the clients vulnerable to different
attacks, we comment of the potential harm, and we propose mitigation.

Distributed Denial of Service (DDoS) leverages the power of multiple servers to disrupt the operations of a victim service. Due to the financial risks posed by downtimes on critical online infrastructure, DDoS is among the top threats in the cybersecurity landscape.

In this paper, we analyze the characteristics of previously launched DDoS attacks using collected network data. To extract the characteristics from a network trace file, we expand the DDoS Dissector tool with additional statistics representing the peak traffic strength and the sources of the attack. In addition, we implement an algorithm to parallelize the analysis of large-scale attacks when executed in memory-constrained environments. Our results show that the error difference in the statistics obtained when running the parallelized version and the original one is less than 0.5%.

Furthermore, we investigate several DDoS attacks by analyzing the contained attack vectors and their corresponding characteristics. Our software correctly detects the attack vectors, however, we remark that the output quality is impacted by the percentage of non-attack traffic. In particular, we provide an overview of the current state of the DDoS landscape seen from the point of view of a scrubbing service and study the effect of a Booter takedown on the frequency of DDoS attacks. Lastly, we introduce spoof detection techniques based on the time-to-live value found in the packet headers. From the spoofing analysis, we can deduce the distribution of operating systems that make up the sources of the attack.