RE: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes

[Adam Jacobs <AJacobs () mocana com>]

Infuriating!

________________________________________
From: pool [pool-bounces+ajacobs=mocana.com () lists ntp org] On Behalf Of Luca BRUNO [lucab () debian org]
Sent: Wednesday, January 27, 2016 03:24
To: pool () lists ntp org; oss-security () lists openwall com; linuxbrad () gmail com
Cc: team () security debian org; secalert () redhat com
Subject: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for  scanning purposes

[cross-posted to pool-ntp and oss-sec]

Hi,
while reviewing network logs this morning I spotted some anomalies related
to scan probes, ntp.org pools and IPv6.

It looks like Brad already observed and blogged about this some days ago,
but I haven't seen this discussed in the usual ntp-pools, Debian and
oss-sec ML, so I'm reposting this here:
http://netpatterns.blogspot.de/2016/01/the-rising-sophistication-of-network.html

In summary, some machines (which seem related to the shodan.io scanning project)
are actively participating in pool.ntp.org as IPv6 endpoints.
However, clients connecting to them for NTP timesync, are subsequently scanned
by probes originating from *.scan6.shodan.io hosts.

Confirming original report from Brad, I can add that those scanners seem to
implement some kind of rate-limiting: they will timeout NTP and won't re-scan
recent clients when doing multiple/subsequent NTP requests.
Moreover, this is not targeted/restricted to the Debian pool only, but plague
the whole IPv6 pool, as seen on a sample query to the RedHat pool:

```
$ dig +short -t AAAA 2.rhel.pool.ntp.org | grep -E ':[[:xdigit:]]00[[:xdigit:]]$'
2a03:b0c0:3:d0::18:b001
$ dig +short -x 2a03:b0c0:3:d0::18:b001
analog.data.shodan.io.
```
(Upon querying this server for NTP, the machine immediately got IPv6-scanned
by rock.scan6.shodan.io)

pool.ntp.org services are the default NTP servers in many default configurations
(at least most of Linux distro) and I guess that this kind of behavior is dangerously
increasing the exposure level of way too many systems.

For ntp.org admins: can those rogue server be expunged from the pools, and the whole
shodan.io situation clarified? (Brad's post has a comprehensive endpoints list and
helper tools for detection)

For oss-sec crowd: is there anything we can do to improve the situation and avoid
similar cases in the future? Should crowd-sourced and fundamental services like this
be encouraged to move to a stronger WoT?

Ciao, Luca

--
 .''`.  ** Debian GNU/Linux **  | Luca Bruno (kaeso)
: :'  :   The Universal O.S.    | lucab (AT) debian.org
`. `'`                          | GPG: 0xBB1A3A854F3BBEBF
  `-     http://www.debian.org  | Debian GNU/Linux Developer