Looking at http://mtc.sri.com/Conficker/addendumC/, it appears that it gets the time from an HTTP response coming from a few dozen major websites. The responding IP is checked against a blacklist of IPs. Additionally, if the returned IP is a duplicate of one returned from a previous request, that IP is blocked as well. So the network time could be spoofed, but you'd need to set up multiple http servers,each with unique IPs that are aren't on the blacklist.
I'd imagine the developers were bright enough to supply the node with the ability to grab the time from a reliable network source, rather than the local system.
Slashdot Mirror
How this, the rallying cry of Revelations addled bigots for hundreds of years now, is moderated insightful is beyond me.
Looking at http://mtc.sri.com/Conficker/addendumC/, it appears that it gets the time from an HTTP response coming from a few dozen major websites. The responding IP is checked against a blacklist of IPs. Additionally, if the returned IP is a duplicate of one returned from a previous request, that IP is blocked as well. So the network time could be spoofed, but you'd need to set up multiple http servers,each with unique IPs that are aren't on the blacklist.
I'd imagine the developers were bright enough to supply the node with the ability to grab the time from a reliable network source, rather than the local system.
You're just not cut out for a career in law enforcement. Or software sales for that matter...