2038 Is Gonna Be Epoch!

The talk opens by framing modern infrastructure as a fragile machine that depends on shared time, then traces how Unix time, stored as a signed 32-bit counter since 1970, runs out in January 2038. The speakers place this beside the NTP rollover in 2036, explaining that early designers chose small fields to save memory, and compare the problem with the slow IPv4 transition.

The middle of the talk covers measurement. With no complete inventory available, the speakers combined internet-wide scanning of SNMP and NTP servers, sinkhole telemetry from smart TVs, and firmware and SBOM data. They reported that roughly a third of scanned NTP servers still ran vulnerable versions, that most fingerprinted SNMP hosts were 32-bit, and that devices such as connected tank monitors and smart TVs failed when tested with shifted dates. They also argued that GPS spoofing and NTP manipulation make time-based attacks cheap today.

The closing section argues that remediation depends more on coordination, procurement and economics than on code, drawing parallels to Y2K. It proposes triaging by impact, starting with life safety, and offers practical steps: test failover behaviour, inventory assets, use authenticated and local time sources, isolate control networks, and ask vendors to prove post-2038 validity. The main takeaway for practitioners is to start the inventory and testing now.