Cleaning the NTP Pool: Detecting and Mitigating NTP-Sourced IPv6 Scanning

• URL: http://arxiv.org/abs/2607.21903v2
• Date: Mon, 27 Jul 2026 13:28:16 GMT
• Title: Cleaning the NTP Pool: Detecting and Mitigating NTP-Sourced IPv6 Scanning
• Abstract summary: The ephemeral and random nature of IPv6 client addresses presents a practical challenge to attacks that depend on Internet-wide scanning or reconnaissance.<n>We develop a methodology to rigorously identify such IPv6 address harvesting and the entities gathering addresses.<n>We identify 22 NTP Pool servers, within 4 primary clusters, that are part of larger monitoring infrastructures that utilize the gathered addresses for reconnaissance, port scanning, and service and vulnerability enumeration.
• Score: 1.2891210250935148
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The ephemeral and random nature of IPv6 client addresses presents a practical challenge to attacks that depend on Internet-wide scanning or reconnaissance -- the adversary must first \emph{find} the client's IPv6 address. While a well-positioned passive adversary can potentially harvest some active IPv6 client addresses, such power is typically reserved for e.g. large CDN or Internet exchange points. In contrast, prior work has shown the feasibility of a low-power entity to easily join the volunteer-based NTP Pool and harvest large quantities of active IPv6 client addresses. In this work, we develop a methodology to not only rigorously identify such IPv6 address harvesting and the entities gathering addresses, but also characterize \emph{what} these entities subsequently do with the addresses. Specifically, we query all NTP Pool servers across the global Internet over the course of one-year using unique IPv6 client addresses, and monitor and correlate any later activity targeting these addresses. In sum, we identify 22 NTP Pool servers, within 4 primary clusters, that are part of larger monitoring infrastructures that utilize the gathered addresses for reconnaissance, port scanning, and service and vulnerability enumeration. To better understand the legal and ethical gray area of such behavior, we both engage with the NTP Pool operators and a cybersecurity insurance firm running one of the harvesting and scanning clusters. We are in discussions with the NTP Pool to integrate our system into their monitoring infrastructure to remove such NTP servers, and the cybersecurity insurance firm changed its operational policy to be more transparent and provide clear opt-out mechanisms.

Related papers

• Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks [56.2003512635877]
  6G Zero-Touch Networks (ZTNs) represent a transformative paradigm toward fully automated and intelligent network management.<n>Security automation aims to enable intelligent security management across dynamic and complex environments.
  arXiv  Detail & Related papers  (2025-12-10T10:04:11Z)
• Towards Federated Clustering: A Client-wise Private Graph Aggregation Framework [57.04850867402913]
  Federated clustering addresses the challenge of extracting patterns from decentralized, unlabeled data.<n>We propose Structural Privacy-Preserving Federated Graph Clustering (SPP-FGC), a novel algorithm that innovatively leverages local structural graphs as the primary medium for privacy-preserving knowledge sharing.<n>Our framework achieves state-of-the-art performance, improving clustering accuracy by up to 10% (NMI) over federated baselines while maintaining provable privacy guarantees.
  arXiv  Detail & Related papers  (2025-11-14T03:05:22Z)
• Off-Path TCP Exploits: PMTUD Breaks TCP Connection Isolation in IP Address Sharing Scenarios [21.746759860459136]
  Path MTU Discovery (PMTUD) and IP address sharing are integral aspects of modern Internet infrastructure.<n>We reveal that PMTUD is inadequately designed to handle IP address sharing, creating vulnerabilities that attackers can exploit to perform off-path TCP hijacking attacks.
  arXiv  Detail & Related papers  (2025-09-15T12:19:02Z)
• Where Have All the Firewalls Gone? Security Consequences of Residential IPv6 Transition [5.833756501605651]
  As the Internet transitions to majority IPv6, residential connections no longer require the use of NAT.<n>We show that we are able to reach more printers, iPhones, and smart lights over IPv6 than full IPv4-wide scans could.
  arXiv  Detail & Related papers  (2025-09-05T04:09:47Z)
• ChamaleoNet: Programmable Passive Probe for Enhanced Visibility on Erroneous Traffic [48.87214752144106]
  ChamaleoNet transforms any production network into a transparent monitor to let administrators collect unsolicited and erroneous traffic directed to hosts.<n>ChamaleoNet is programmed to ignore well-formed traffic and collect only erroneous packets.<n>Simple analytics unveil internal and infected hosts, identify temporary failures, and enhance visibility on external radiation produced by attackers looking for vulnerable services.
  arXiv  Detail & Related papers  (2025-08-17T20:54:41Z)
• Toward Mixture-of-Experts Enabled Trustworthy Semantic Communication for 6G Networks [82.3753728955968]
  We introduce a novel Mixture-of-Experts (MoE)-based SemCom system. This system comprises a gating network and multiple experts, each specializing in different security challenges. The gating network adaptively selects suitable experts to counter heterogeneous attacks based on user-defined security requirements. A case study in vehicular networks demonstrates the efficacy of the MoE-based SemCom system.
  arXiv  Detail & Related papers  (2024-09-24T03:17:51Z)
• A Taxonomy and Comparative Analysis of IPv4 Identifier Selection Correctness, Security, and Performance [1.974812353055775]
  The battle for a more secure Internet is waged on many fronts, including the most basic of networking protocols.<n>This article taxonomizes the 25-year history of IPID-based exploits and the corresponding changes to IPID selection methods.
  arXiv  Detail & Related papers  (2024-06-10T17:22:17Z)
• VN Network: Embedding Newly Emerging Entities with Virtual Neighbors [59.906332784508706]
  We propose a novel framework, namely Virtual Neighbor (VN) network, to address three key challenges. First, to reduce the neighbor sparsity problem, we introduce the concept of the virtual neighbors inferred by rules. Secondly, we identify both logic and symmetric path rules to capture complex patterns.
  arXiv  Detail & Related papers  (2024-02-21T03:04:34Z)
• Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience [50.460555688927826]
  We propose the Graph Agent Network (GAgN) to address the vulnerabilities of graph neural networks (GNNs)<n>GAgN is a graph-structured agent network in which each node is designed as an 1-hop-view agent.<n>Agents' limited view prevents malicious messages from propagating globally in GAgN, thereby resisting global-optimization-based secondary attacks.
  arXiv  Detail & Related papers  (2023-06-12T07:27:31Z)
• Secure IP Address Allocation at Cloud Scale [8.838701631824616]
  Dynamic allocation of IP addresses can be abused by adversaries to source malicious traffic, bypass rate limiting systems, and even capture traffic intended for other cloud tenants. In this paper, we develop a practical defense for IP address allocation through such an analysis. We show that principled analysis and implementation of cloud IP address allocation can lead to substantial security gains for tenants and their users.
  arXiv  Detail & Related papers  (2022-10-26T19:40:10Z)
• SiamHAN: IPv6 Address Correlation Attacks on TLS Encrypted Traffic via Siamese Heterogeneous Graph Attention Network [10.299611702673635]
  IPv6 addresses could easily be correlated with user activity, endangering their privacy. Mitigations to address this privacy concern have been deployed, making existing approaches for address-to-user correlation unreliable. This work demonstrates that an adversary could still correlate IPv6 addresses with users accurately, even with these protection mechanisms.
  arXiv  Detail & Related papers  (2022-04-20T13:54:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.