Biz & IT —

Using IPv6 with Linux? You’ve likely been visited by Shodan and other scanners

Shodan caught using time-keeping servers to quietly harvest IP addresses.

Using IPv6 with Linux? You’ve likely been visited by Shodan and other scanners
shodan.io

One of the benefits of the next-generation Internet protocol known as IPv6 is the enhanced privacy it offers over its IPv4 predecessor. With a staggering 2128 (or about 3.4×1038) theoretical addresses available, its IP pool is immune to the types of systematic scans that criminal hackers and researchers routinely perform to locate vulnerable devices and networks with IPv4 addresses. What's more, IPv6 addresses can contain regularly changing, partially randomized extensions. Together, the IPv6 features cloak devices in a quasi anonymity that's not possible with IPv4.

Now, network administrators have discovered a clever way that scanners are piercing the IPv6 cloak of obscurity. By setting up an IPv6-based network time protocol service most Internet-connected devices rely on to keep their internal clocks accurate, the operators can harvest huge numbers of IPv6 addresses that would otherwise remain unknown. The server operators can then scan hundreds or thousands of ports attached to each address to identify publicly available surveillance cameras, unpatched servers, and similar vulnerabilities.

Shodan—the vulnerability search engine that indexes Internet-connected devices—has been quietly contributing NTP services for months to the cluster of volunteer time servers known as the NTP Pool Project. To increase the number of connections to three recently identified Shodan-run servers, each one had 15 virtual IP addresses. The added addresses effectively multiplied the volume of traffic they received by 15-fold, increasing the odds that Shodan would see new devices. Within seconds of one of the Shodan's NTP servers receiving a query from an IPv6 device, Shodan's main scanning engine would scan more than 100 ports belonging to the device. The Shodan scanner would then revisit the device roughly once a day.

Shodan's harvesting scheme came to an abrupt end on Thursday, when NTP Pool Project maintainers ejected the Shodan time-keeping servers from the cluster. Many people say the removal was only fair, since the harvesting wasn't disclosed and went well beyond the service advertised by NTP Time Project. Still, if Shodan-run NTP servers were harvesting IPv6 addresses, it's a reasonable bet that others were and probably still are doing the same thing. And, of course, it wouldn't be a stretch if non-NTP services that receive queries from IPv6 devices are, too. In the end, that means the IPv6 privacy assurances may be diminished in the process.

“Choose the websites you visit carefully”

"I might just be too cynical, but [harvesting] also feels like something we should come to expect," Ask Bjørn Hansen, an NTP Pool Project maintainer, wrote in a post to a security forum announcing the decision to drop Shodan. "The NTP pool usage being the source sucks, but in general I am sure we will see more of this as IPv6 usage goes up. Because you can't scan the IPv6 space, there will be some value in 'active addresses,' so eventually we will see IP addresses traded like other [personally identifying information] data is now. Choose the websites you visit carefully?"

Officials with Shodan declined to comment for this post.

IPv6 accounts for only a small portion of today's Internet traffic, but there's little doubt that it's growing rapidly. About 10 percent of people accessing Google use the next-generation protocol, up from 6 percent last year and just 1 percent in 2013. Virtually all desktop, server, and mobile operating systems released over the past decade offer IPv6 connectivity by default. The ongoing exhaustion of addresses available in the IPv4 pool, combined with the proliferation of Internet-connected cameras, TVs, and other everyday devices, has analysts forecasting an explosion of IPv6 traffic over the next decade. Virtually all distributions of Linux by default use IPv6 to query servers in the NTP pool.

The v6 adoption has presented a quandary for researchers and criminal hackers alike. The entire IPv4 address space can be scanned in a matter of minutes or hours, depending on the equipment used and how thorough the probes are. What's more, v4 addresses assigned to servers, computers, and routers often stay active for months or years. With orders of magnitude more v6 addresses that in many cases change every day or so, there's no reliable way to probe devices that use IPv6.

"The obscurity is really good with IPv6," Rob Graham, CEO of security firm Errata Security, told Ars. "That's what we're relying on. People are assuming it provides a lot of security."

The added security seems to have lulled some administrators and hardware manufacturers into thinking v6 devices don't need the same types of defenses that are standard for their v4 counterparts. The Buffalo WZR-HP-G300NH wireless router, for instance, supports IPv6 routing but omits IPv6 firewall capabilities that are typical with IPv4. Many v4 devices rely on network address translation, which assigns devices inside a home or corporate network an address that's not reachable on the open Internet. In large part, it becomes the firewall for v4 devices.

IPv6, by contrast, gives devices inside a private network a globally reachable IP address, a design that works in opposition to the entire objective of network address translation. Shodan's harvesting of addresses from the NTP Pool Project puts such security-through-obscurity approaches to rest.

Whodunnit (and how)?

The revelations about Shodan surfaced in a blog post published earlier this month by Brad Hein, a network administrator and security researcher. Beginning in August, he told Ars, a steady stream of unsolicited network scans that probed 115 separate ports started being directed at IPv6 devices in his laboratory. The devices, which were running the Debian based Raspbian distribution of Linux, had addresses containing randomized extensions that weren't indexed in domain name system lookups or any other public records. What's more, firewall logs showed that none of the scanned devices had ever made outbound connections to the scanner addresses. Although the firewall prevented the scan packets from reaching the devices, Hein's curiosity was piqued, to say the least.

Hein noticed the targeted devices regularly contacted NTP servers to adjust their clocks, so he used a device with a fresh v6 address to connect to some of the same time servers his scanned devices had used in the past. For testing purposes, he used a unique address to ping each timekeeper. Before connecting to a new one, he would refresh the device IP address. Eventually, within five seconds of contacting one recently pinged time server, the same 115 ports of the unique address were suddenly scanned. Hein had finally gotten the big break he had been looking for.

After several weeks of testing, he had a list of 45 IP addresses in the NTP Pool Project cluster that triggered scans, always within about five seconds. When he performed DNS lookups, he found that the IP addresses of the NTP servers and a completely different set of IP addresses used by the scanners all corresponded to domain names belonging to Shodan. Last week, several participants in an Internet forum reported they were able to reproduce Hein's results. The evidence left little doubt that Shodan was using NTP servers to harvest v6 addresses so they could be scanned for vulnerabilities.

Resistance is (mostly) futile

Some of the forum participants have proposed remedies such as using a secondary v6 address to make NTP queries or even for all outgoing connections. It's not clear how much meaningful protection would come from such approaches given the five-second turnaround time from outgoing NTP query to incoming scan. The proposed fix would also do little to prevent abuse by other services, such as websites, messaging, DNS, and e-mail that also receive incoming connections from IPv6 devices. Hein said he supports using IPv6 addresses once per connection and limiting the lifespan of an IPv6 address to a single connection. Once the connection is closed, the IPv6 address would be deallocated.

"This would generate a huge volume of IPv6 addresses for routers and network systems to have to keep track of, but it would be the most secure," he said. "I suppose this is the other side of the spectrum from what we see today with temp addresses, which live for about a day at a time and accept inbound connections during that whole time."

Ultimately, at least for the foreseeable future, people would do better to accept that some amount of harvesting will unavoidable and that admins will have to apply the same stringent firewall regimens to IPv6 devices that have long been required to keep v4 devices safe.

"I (too) might just be too cynical, or in this business too long, but I feel that if you communicate on the global Internet, you should expect to be probed," one participant in the discussion wrote. "If you’re not ready to be probed, your machine shouldn’t be on the Net. Really. One can probe the entire v4 Internet in minutes, so being probed should not be new to any device on it. The fact that the v6 address space takes ... slightly longer ;) to probe should not make one lazy and rely on security by obscurity, hoping that your machine will not be seen."

Channel Ars Technica