Comment by tyingq | Hacker News Reader

Comment by tyingq | Hacker News Reader

It seems like many aren't quite getting what's going on here...here's a brief overview:

Shodan.io fancies itself as a search engine where you can search for IOT things (webcams, refrigerators, etc) that are on the internet.

They have no technical issues doing this in the IPV4 space, because it's easy enough to scan every single address in the space.

This isn't practical for IPV6. So, it seems they wanted a way to identify every IOT device in the IPV6 space without having to scan all of it.

At least one approach they found was to join the ntp.org pool[1], and effectively donate server time. Since pool.ntp.org is the default NTP server listed for many linux distros (and thus, probably IOT devices), they now are getting live connections from the exact devices they want to index on their search engine.

Once you connect, they scan you back on 100 ports on so (ports unrelated to NTP) to see if you are a webcam, router, or whatever else they want to put in their index.

Pretty shady. Kind of like volunteering for a charity so that you can raid their internal mailing list for spam purposes.

[1]http://www.pool.ntp.org/join.html

> Pretty shady.

Sort of, but in the global order of shadiness, this ranks pretty far below what your typical multinational corporation does to track an individual. It's pretty ingenious actually.

I don't really see what's shady about it. If you connect to a server, it's accepted and expected that they'll get your IP address.

They run a port scan against your ip and publish the discovered info publicly. You may find that okay, others don't.

Well then I guess people should stop relying on their IP address being one of many in a vast space for security and implement proper authentication instead.

It's not like your service has to expose all its secrets to an unauthenticated client sending you a GET / HTTP/1.1.

That's not the irk. Rude behavior isn't suddenly polite just because I have great security. The spirit of donating server time to the ntp.org pool is not to use the data for your own self promotion.

The real-life equivalent is a pizza delivery guy who, after delivering the pizza, goes around your house, checks which doors and windows are locked, unlocked or open, what brand the locks and the burglar alarm are and then proceeds to sell this data.

I hope the NTP pool terms of service will disallow such behaviour in the future, otherwise I'm removing my server from the pool.

So next up ntp clients that support blacklists?

just spin up a separate network namespace and macvlan device to run your ntpd in. it'll get a separate v6 address via router advertisement and ntpd will be the only thing listening on that address.

just wrap ntpd in firejail[1].

ipv6-per-networked-process pretty much brings an end to portscanning.

[1] https://firejail.wordpress.com/

Someone knowledgeable enough to do that, probably doesn't have any vulnerable services open anyway.

Good idea. But I have to ask... "just"? Really? :)

Granted, ideally distros would do that for you out-of-the-box.

Could switch over to NIST at time.nist.gov See http://tf.nist.gov/tf-cgi/servers.cgi for info/details

Granted that means trusting NIST over someone else.

The other options are getting time from a cellular modems, GPS or the most extreme running your own atomic clock.

What a novel idea. There is nothing wrong with this. Why be afraid of scans?

They are taking the data from the scans and building a nice easy to use searchable signature database for script kiddie hackers. At the very least, it's impolite.

If they know what software you are running, the minute there is a new vulnerability revealed, they can break into your system. It gives you less time to patch your stuff. You think this is the stuff of fantasy? Read https://www.drupal.org/PSA-2014-003

Reply on news.ycombinator.com