TIMECRIME attack and Linux kernel missing randomization.

Author: hackerhouse-opensource

timecrime.c

@@ -14,7 +14,9 @@
  * Hosts with randomized timestamps are protected from such attacks, while others
  * may expose detailed system uptime and time information that attackers can use in
  * subsequent attacks. Attack scenarios could include hosts that use system time to seed
- * random generators to generate passwords as an example.
+ * random generators to generate passwords as an example, testing when a system rebooted
+ * to understand maintenance cycles, automated patching, testing if a kernel panic DoS
+ * was successful and lastly fingerprinting with systems exposed behind NAT.
  *
  * The tool sends TCP SYN packets with timestamp options to target hosts and
  * analyzes the returned timestamp values to determine:
@@ -40,6 +42,21 @@
  * Environment Variables:
  * DEBUG=1 Enable packet-level hex dump tracing
  *
+ * Linux Kernel TIMECRIME attack
+ * =============================
+ * Linux sysctl can be 0 - disable, 1 - randomized, 2 - insecure.
+ * e.g. "sudo sysctl -w net.ipv4.tcp_timestamps=2" to test PoC.
+ *
+ * We have noticed that on some Linux distributions net.ipv4.tcp_timestamps=1
+ * (the "randomized" default) DOES NOT RANDOMIZE PER-CONNECTION on real kernels.
+ * Tested on DigitalOcean using kernel 6.12.48, Debian 13, 2025-11-07. Identical
+ * monotonic 1000 Hz curve is seen with both 1 or 2 set. RFC 7323 §3.2 requires
+ * per-connection jitter — Linux appears to ignore it.
+ *
+ * Impact: Any Internet-facing Linux box leaks exact boot time and OS fingerprint to
+ * an unauthenticated attacker despite intending to randomize the data.
+ * CVSS 5.3  (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
+ *
  * Author: hackerfantastic
  * Website: https://hacker.house/
  *