oss-sec mailing list archives
Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes
From: Ask Bjørn Hansen <ask () ntppool org>
Date: Thu, 28 Jan 2016 09:38:33 -0800
Hi Luca (and everyone), I removed those servers yesterday. Brad had been helping look to see if others were doing something similar. I think the behavior was falling well outside what's reasonably expected from a server operator participating in the pool. The operator had also been adding the same server multiple times in order to "attract" more traffic which is definitely outside the guidelines. It's not something we want to support, though being the "connector" between users and volunteer server operators on an protocol without any encryption or authentication we can't pretend there's more control than there is. I might just be too cynical, but it also feels like something we should come to expect. Anyone who's looked at traffic to an Internet facing IPv4 address have seen much worse. The NTP pool usage being the source sucks, but in general I am sure we will see more of this as IPv6 usage goes up. Because you can't scan the IPv6 space, there will be some value in "active addresses" so eventually we will see IP addresses traded like other PII data is now. Choose the websites you visit carefully? Ask -- http://www.ntppool.org/
Current thread:
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes, (continued)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Kurt Seifried (Jan 27)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Zach W. (Jan 27)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Hazel (Jan 29)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes enki (Jan 29)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Scott Herbert (Jan 29)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Daniel Micay (Jan 29)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Daniel Micay (Jan 29)
- Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Kurt Seifried (Jan 27)
- Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Rob Janssen (Jan 28)
- Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Asbjorn Hojmark (Jan 28)