[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <056121F3-6A4C-4962-B3EC-CE294DDF5C5F@ntppool.org>
Date: Thu, 28 Jan 2016 09:38:33 -0800
From: Ask Bjørn Hansen <ask@...pool.org>
To: Luca BRUNO <lucab@...ian.org>
Cc: pool@...ts.ntp.org, oss-security@...ts.openwall.com, linuxbrad@...il.com,
team@...urity.debian.org, secalert@...hat.com
Subject: Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes
Hi Luca (and everyone),
I removed those servers yesterday. Brad had been helping look to see if others were doing something similar.
I think the behavior was falling well outside what's reasonably expected from a server operator participating in the pool.
The operator had also been adding the same server multiple times in order to "attract" more traffic which is definitely outside the guidelines.
It's not something we want to support, though being the "connector" between users and volunteer server operators on an protocol without any encryption or authentication we can't pretend there's more control than there is.
I might just be too cynical, but it also feels like something we should come to expect. Anyone who's looked at traffic to an Internet facing IPv4 address have seen much worse.
The NTP pool usage being the source sucks, but in general I am sure we will see more of this as IPv6 usage goes up. Because you can't scan the IPv6 space, there will be some value in "active addresses" so eventually we will see IP addresses traded like other PII data is now. Choose the websites you visit carefully?
Ask
--
http://www.ntppool.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
