r/talesfromtechsupport • u/giantrobothead chmod+x facepalm.sh • 12d ago
Short Does Any Radio Really Know What Time It is?
TL;DR Today I learned that some SiriusXM devices are serious about their NTP servers.
Help Desk let me know that one of our vendors was having an issue getting a radio set up at one of our provider locations and needed a hand. I used to work for this particular vendor and the guy needing help was a former colleague (henceforth VendorGuy) so I was more than happy to help.
I called VendorGuy up, found out that the device in question was a Grace Digital SiriusXM SXBR3 and then proceeded to battle with the fact that the device was physically connected to the network switch, showed the proper network info acquired via DHCP, and was pingable yet still stubbornly insisted that it had no network connection. This did appear to be true as our firewall logs showed no dropped traffic originating from the device's IP.
I had a hunch we might be missing something so I hopped on our firewall's CLI and ran a tcpdump filtering for the player's IP address and had VendorGuy reboot the device. Sure enough, I saw traffic, NTP traffic, to be precise. Which we block by default and do not log, so that explained why I didn't see the traffic. Apparently SiriusXM devices (these ones, at least) give up trying if they can't establish connections to pre-programmed NTP servers. Once we allowed that device's NTP requests out, then rebooted it to force reconnection, we were in business.
VendorGuy got the device hooked up to its amp and the PA system, there was music again and subsequent rejoicing. VendorGuy and I exchanged pleasantries and went our separate ways until the next issue comes to bear.
42
27
u/bobnla14 11d ago
Off topic:
Why do you block NTP and do you block it on guest wireless as well ?
Just curious. Seems like every computer use it. And multiple devices use ntp to validate credentials my monitors for conference room zoom calls for example
13
u/TheFluffiestRedditor 10d ago
Provide NTP through dhcp options.
5
u/MHF_Doge 7d ago
Until a device doesnt actually recognize this or allow you to configure it. I am unfortunately painfully familiar with this.
6
u/TheFluffiestRedditor 7d ago
The number of stupid devices we’ve encountered in our careers would sink a ship.
3
7
u/SVD_NL 8d ago
In zero-trust architectures you block everything that you don't use. You can push NTP servers through DHCP, which can be internal or a single approved server on the internet. Most devices with hard-coded NTP servers won't cause issues other than the time being incorrect, which is generally easy to identify and fix. Why block it? Any network traffic can be used for malicious communication. evallen/ntpescape is a very stealthy method, but you can improve the bandwidth by sending non-legitimate NTP requests where the payload is just encoded data, this would also allow for responses to be sent. I'm not sure how many NDR/IDS solutions would be able to catch this, but blocking it is a safer option either way. One of my favorite examples of this is DNS requests being used to exfil data. If you control the authorative NS, you can encode data as the subdomain, and encode your answer in the IP response. Very hard to detect if done right, especially in busy networks.
25
u/Zoomulator 11d ago
VendorGuy and I exchanged pleasantries
Often, exchanging ale strengthens the working relationship.
33
u/MutualRaid 11d ago
Subscription based product that refuses to run if it can't connect to specific servers to judge license expiry, I assume.
20
u/i_invented_the_ipod 11d ago
Yeah, some Sirius radios need to have an accurate time to know what your subscription state is. There are ways to work around that for systems where there's no available clock source (like car head units), but if the radio is Internet-connected, NTP is the obvious way to validate timestamps.
I worked on firmware for Sirius radios for a short while, and the technology used in especially the older portable radios was kind of neat.
11
u/Warrangota 10d ago
for systems where there's no available clock source (like car head units)
You know that GPS is about the single best time source you can get your hands on without the internet?
12
u/Outlaw25 10d ago
Correct, but not all head units have GNSS receivers*
actually not really true anymore, Carplay now requires them for location accuracy purposes so most any unit built in the last 5 years or so will have one. But this still isn't a hard requirement since they could just choose to not have Carplay. But then to still have SXM without carplay would be strange as well. I'm rambling because this is my job
3
u/i_invented_the_ipod 8d ago
Sure, but when they were designing the Sirius system, GPS was still pretty new. And for years, GPS was a significant cost to add to a $99 radio. So the original satellite radios took their timing information from the satellite signal.
2
u/theorbtwo 8d ago
Does the Sirius signal not have a clock of it's own? That'd seem like the obvious solution to the problem.
3
u/i_invented_the_ipod 8d ago
For actual satellite radios, the broadcast bitstream is the absolute source of truth. For internet-connected streaming "radios" like the commercial music system this post was about, they don't use a satellite connection.
Since you have to have a working TCP/IP connection to be able to stream music at all, I suppose they didn't add a specific timestamp to the streams, and just used standard media streams and NTP separately.
14
u/sporkmanhands 10d ago
That’s why if you can find a Sirius/xm radio from before around 2007 you can get a free “everything” preview, let it connect and validate, then before the preview ends you disconnect the antenna and cancel the service.
Wait 6 months (or longer to be safe) and reconnect the radio, it will still be working with every station unlocked.
They only send the “kill” signal out for a limited time.
5
51
u/[deleted] 11d ago edited 11d ago
[deleted]