[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50DADDE6B33B1B47904E685AAFDC182448CF2B4300@yugi.mocana.local>
Date: Wed, 27 Jan 2016 07:59:36 -0800
From: Adam Jacobs <AJacobs@...ana.com>
To: Luca BRUNO <lucab@...ian.org>, "pool@...ts.ntp.org" <pool@...ts.ntp.org>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"linuxbrad@...il.com" <linuxbrad@...il.com>
CC: "team@...urity.debian.org" <team@...urity.debian.org>,
"secalert@...hat.com" <secalert@...hat.com>
Subject: RE: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for
scanning purposes
Infuriating!
________________________________________
From: pool [pool-bounces+ajacobs=mocana.com@...ts.ntp.org] On Behalf Of Luca BRUNO [lucab@...ian.org]
Sent: Wednesday, January 27, 2016 03:24
To: pool@...ts.ntp.org; oss-security@...ts.openwall.com; linuxbrad@...il.com
Cc: team@...urity.debian.org; secalert@...hat.com
Subject: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes
[cross-posted to pool-ntp and oss-sec]
Hi,
while reviewing network logs this morning I spotted some anomalies related
to scan probes, ntp.org pools and IPv6.
It looks like Brad already observed and blogged about this some days ago,
but I haven't seen this discussed in the usual ntp-pools, Debian and
oss-sec ML, so I'm reposting this here:
http://netpatterns.blogspot.de/2016/01/the-rising-sophistication-of-network.html
In summary, some machines (which seem related to the shodan.io scanning project)
are actively participating in pool.ntp.org as IPv6 endpoints.
However, clients connecting to them for NTP timesync, are subsequently scanned
by probes originating from *.scan6.shodan.io hosts.
Confirming original report from Brad, I can add that those scanners seem to
implement some kind of rate-limiting: they will timeout NTP and won't re-scan
recent clients when doing multiple/subsequent NTP requests.
Moreover, this is not targeted/restricted to the Debian pool only, but plague
the whole IPv6 pool, as seen on a sample query to the RedHat pool:
```
$ dig +short -t AAAA 2.rhel.pool.ntp.org | grep -E ':[[:xdigit:]]00[[:xdigit:]]$'
2a03:b0c0:3:d0::18:b001
$ dig +short -x 2a03:b0c0:3:d0::18:b001
analog.data.shodan.io.
```
(Upon querying this server for NTP, the machine immediately got IPv6-scanned
by rock.scan6.shodan.io)
pool.ntp.org services are the default NTP servers in many default configurations
(at least most of Linux distro) and I guess that this kind of behavior is dangerously
increasing the exposure level of way too many systems.
For ntp.org admins: can those rogue server be expunged from the pools, and the whole
shodan.io situation clarified? (Brad's post has a comprehensive endpoints list and
helper tools for detection)
For oss-sec crowd: is there anything we can do to improve the situation and avoid
similar cases in the future? Should crowd-sourced and fundamental services like this
be encouraged to move to a stronger WoT?
Ciao, Luca
--
.''`. ** Debian GNU/Linux ** | Luca Bruno (kaeso)
: :' : The Universal O.S. | lucab (AT) debian.org
`. `'` | GPG: 0xBB1A3A854F3BBEBF
`- http://www.debian.org | Debian GNU/Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
