Subject:
Re: shodan.io actively infiltrating ntp.org IPv6 pools for,> scanning
purposes (Ask Bj?rn Hansen)
From:
"Ray Hunter (v6ops)" <[email protected] <mailto:[email protected]>>
Date:
Fri, 29 Jan 2016 13:56:28 +0100
To:
[email protected] <mailto:[email protected]>
Hi Luca (and everyone),
I removed those servers yesterday. Brad had been helping look to see
if others were doing something similar.
I think the behavior was falling well outside what's reasonably
expected from a server operator participating in the pool.
The operator had also been adding the same server multiple times in
order to "attract" more traffic which is definitely outside the
guidelines.
It's not something we want to support, though being the "connector"
between users and volunteer server operators on an protocol without
any encryption or authentication we can't pretend there's more control
than there is.
I might just be too cynical, but it also feels like something we
should come to expect. Anyone who's looked at traffic to an Internet
facing IPv4 address have seen much worse.
The NTP pool usage being the source sucks, but in general I am sure we
will see more of this as IPv6 usage goes up. Because you can't scan
the IPv6 space, there will be some value in "active addresses" so
eventually we will see IP addresses traded like other PII data is now.
Choose the websites you visit carefully?
Ask
I'm also convinced the NTP pool is not the first, nor will it be the
last, service to be abused for facilitating nefarious scanning.
Perhaps quoting an official IETF Best Current Practice RFC in the terms
of use could cover you/ justify removing these servers from the pool/
taking other actions?
https://tools.ietf.org/pdf/rfc7258.pdf Pervasive Monitoring is
Considered an Attack.
--
regards,
RayH
<https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campaign=reach>
_______________________________________________
pool mailing list
[email protected]
http://lists.ntp.org/listinfo/pool
