chriso0710/pikiosk

ntp-udp from tor exit node

Closed this issue · 2 comments

nibelungen commented

Hi,

i tried your project - works fine so far. Thanks.
But after some time running it tried to connect with ntp-udp (port 123) to a tor exit node which is known as
involved with the current wanna cry worm.

Any ideas on that???

Thanks in advance.

chriso0710 commented

No, sorry, I have no idea :-)
Please take a detailed look at the description and the source files to verify that this Pi project only consists of ansible playbooks and templates.

I don't think that this project is the right place for your question. Maybe you would have more success in the support forums of your Linux distribution. You certainly should provide some evidence and details proving your statement.

You may also want to check the download sources for your Linux distribution.

Christian

nibelungen commented

Thanks for reply, totally was my fault!!
There is a well known IP address in the ntp pool http://www.pool.ntp.org/scores/146.0.32.144 which is an Tor Exit Node and listed in many blacklist in case of wannacry.
This IP was hit multiple times (each reboot)... Thats the reason why i got an alert.

Sorry for the impact with your project, it is - as you pointed out - an default setting in raspbian
or better to say everyone who use poo.ntp.org could hit that ip.

regards,
andreas