Re: shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes

[Scott Herbert <scott.a.herbert () googlemail com>]

That would be nice sure, but given that IoT vendors are rushing so
fast to market that their doing things like sending login credentials
via http, I think we're a long way from having them secure their
products from scanning let alone anything else.

On 29 January 2016 at 15:47, enki <enki () fsck pl> wrote:
> ---- Wł. Pt, 29 sty 2016 15:21:01 +0100 Hazel  napisał(a) ----
> > On 27 January 2016 at 14:43, Kurt Seifried <kseifried () redhat com> wrote:
> > > On Wed, Jan 27, 2016 at 4:24 AM, Luca BRUNO <lucab () debian org> wrote:
> > > > For oss-sec crowd: is there anything we can do to improve the situation
> > > > and avoid
> > > > similar cases in the future? Should crowd-sourced and fundamental services
> > > > like this
> > > > be encouraged to move to a stronger WoT?
> > >
> > > [...]
> > >
> > > Sadly we can't really rely on the IoT device makers to fix this, they have
> > > basically 0 incentive to prevent scanners from hitting their products
> > > (they're already sold, to late for the customer to make an informed
> > > decision).
> >
> > I hope you'll forgive me making a modest proposal here, but it seems
> > to me that there might be an opportunity here for Linux distributions
> > that are upstream of IoT vendors to modify their default configuration
> > to address this.
> >
> > My somewhat off-the-cuff suggestion would be to...
> >
> > 1. Add an *additional, secondary* IPv6 address to external interfaces that is:
> > -> a. generated in accordance with the IPv6 Privacy Extensions (i.e. RFC 4941)
> > -> b. firewalled by default against all traffic except NTP in either direction
> >
> > 2. Configure the NTP *client* to use this secondary address as the
> > source for outgoing NTP traffic, instead of the default address?
> >
> > ...thereby avoiding revealing the primary address of the host to
> > would-be scanners?
>
> I'd go even further and use the IPv6 privacy-enhanced address for all outgoing connections, not only NTP. It's only a 
> matter of time before someone sets up a debian mirror for example that logs source addresses and launches scans 
> against them.
>
> --
> enki () fsck pl



-- 
--
Web:  http://cryptonot.es/
Twitter: http://twitter.com/Scott_Herbert
Linkedin: http://www.linkedin.com/in/scottaherbert