Comment by walrus01

Apparently they didn't just do that, they also had them make requests way more frequently than they needed to (I guess particularly surprising given that they'd already have to be fairly negligent to have the server hard-coded):

> We learned that these packets appeared to be legitimate, well-formed Simple Network Time Protocol (SNTP) version 1 queries, albeit at an inexplicably high rate from each client host. For instance, during one trace, many clients produced about one query per second. This would be highly unusual for a properly constructed SNTP client, since an application which uses SNTP is merely interested in setting its own clock relatively accurately so that its host has some reasonable notion of the current time. One query per second is ridiculous, and is far from best practice for NTP client behavior.

Would have been fun if the NTP server would return dates in the futures for requests from Netgear equipment, making certificates invalid and giving people an awful experience.

This was a great read, thank you for posting!

I love articles like that.

[flagged]