Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes

[Ask Bjørn Hansen <ask () ntppool org>]

Hi Luca (and everyone),

I removed those servers yesterday. Brad had been helping look to see if others were doing something similar.

I think the behavior was falling well outside what's reasonably expected from a server operator participating in the 
pool.

The operator had also been adding the same server multiple times in order to "attract" more traffic which is definitely 
outside the guidelines.

It's not something we want to support, though being the "connector" between users and volunteer server operators on an 
protocol without any encryption or authentication we can't pretend there's more control than there is.

I might just be too cynical, but it also feels like something we should come to expect. Anyone who's looked at traffic 
to an Internet facing IPv4 address have seen much worse.

The NTP pool usage being the source sucks, but in general I am sure we will see more of this as IPv6 usage goes up. 
Because you can't scan the IPv6 space, there will be some value in "active addresses" so eventually we will see IP 
addresses traded like other PII data is now. Choose the websites you visit carefully?



Ask


-- 
http://www.ntppool.org/