Date: Wed, 27 Jan 2016 07:59:36 -0800 From: Adam Jacobs <AJacobs@...ana.com> To: Luca BRUNO <lucab@...ian.org>, "pool@...ts.ntp.org" <pool@...ts.ntp.org>, "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>, "linuxbrad@...il.com" <linuxbrad@...il.com> CC: "team@...urity.debian.org" <team@...urity.debian.org>, "secalert@...hat.com" <secalert@...hat.com> Subject: RE: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes Infuriating! ________________________________________ From: pool [pool-bounces+ajacobs=mocana.com@...ts.ntp.org] On Behalf Of Luca BRUNO [lucab@...ian.org] Sent: Wednesday, January 27, 2016 03:24 To: pool@...ts.ntp.org; oss-security@...ts.openwall.com; linuxbrad@...il.com Cc: team@...urity.debian.org; secalert@...hat.com Subject: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes [cross-posted to pool-ntp and oss-sec] Hi, while reviewing network logs this morning I spotted some anomalies related to scan probes, ntp.org pools and IPv6. It looks like Brad already observed and blogged about this some days ago, but I haven't seen this discussed in the usual ntp-pools, Debian and oss-sec ML, so I'm reposting this here: http://netpatterns.blogspot.de/2016/01/the-rising-sophistication-of-network.html In summary, some machines (which seem related to the shodan.io scanning project) are actively participating in pool.ntp.org as IPv6 endpoints. However, clients connecting to them for NTP timesync, are subsequently scanned by probes originating from *.scan6.shodan.io hosts. Confirming original report from Brad, I can add that those scanners seem to implement some kind of rate-limiting: they will timeout NTP and won't re-scan recent clients when doing multiple/subsequent NTP requests. Moreover, this is not targeted/restricted to the Debian pool only, but plague the whole IPv6 pool, as seen on a sample query to the RedHat pool: ``` $ dig +short -t AAAA 2.rhel.pool.ntp.org | grep -E ':[[:xdigit:]]00[[:xdigit:]]$' 2a03:b0c0:3:d0::18:b001 $ dig +short -x 2a03:b0c0:3:d0::18:b001 analog.data.shodan.io. ``` (Upon querying this server for NTP, the machine immediately got IPv6-scanned by rock.scan6.shodan.io) pool.ntp.org services are the default NTP servers in many default configurations (at least most of Linux distro) and I guess that this kind of behavior is dangerously increasing the exposure level of way too many systems. For ntp.org admins: can those rogue server be expunged from the pools, and the whole shodan.io situation clarified? (Brad's post has a comprehensive endpoints list and helper tools for detection) For oss-sec crowd: is there anything we can do to improve the situation and avoid similar cases in the future? Should crowd-sourced and fundamental services like this be encouraged to move to a stronger WoT? Ciao, Luca -- .''`. ** Debian GNU/Linux ** | Luca Bruno (kaeso) : :' : The Universal O.S. | lucab (AT) debian.org `. `'` | GPG: 0xBB1A3A854F3BBEBF `- http://www.debian.org | Debian GNU/Linux Developer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.