Imagine the internet as a giant, bustling city where every device has a unique address, like a house number. In the older version of this city (IPv4), the streets were crowded, and it was easy for someone to walk down every block, knocking on every door, and see who was home. But in the new, massive expansion of the city (IPv6), the streets are so long and the house numbers are so random and constantly changing that it's nearly impossible to find anyone just by guessing. You'd need a map that updates every second.

To keep their clocks synchronized, most devices in this city don't just guess the time; they ask a central timekeeper called the NTP Pool. Think of the NTP Pool as a massive, volunteer-run clock tower where anyone can set up a clock and offer the time to the neighborhood. Because it's so popular, millions of devices ask these clocks for the time every day. The catch? When a device asks for the time, it has to show its "house number" (its IP address) so the clock knows where to send the answer. This paper explores a sneaky trick where some people are using these volunteer clocks not just to tell time, but to secretly write down the house numbers of everyone who stops by, and then use that list to go knocking on doors they wouldn't have found otherwise.

The Clock Tower Heist

In this study, researchers Erik Rye and Robert Beverly decided to investigate a strange phenomenon they called "back-scanning." They suspected that some of the volunteer clocks in the NTP Pool were acting like spies. Here's how the trick works: A device asks a clock for the time. The clock sees the device's address, writes it down, and then—instead of just sending the time back—starts sending probes to that address to see what services are running on it. It's like a friendly baker who, after you ask for the time, secretly starts checking if your house has a locked door, a security camera, or a hidden safe, all because you walked into their shop.

To catch these spies, the researchers set up a clever trap. They created a special "prober" computer that sent thousands of requests to the NTP Pool clocks. But here's the magic: every single request came from a brand new, fake, one-time-only house number (called a "nonce"). These numbers were random and never used again. The researchers then waited to see if anyone would knock on the door of these fake houses.

If a clock was just doing its job, it would reply with the time and forget about the fake house number. But if a clock was a spy, it would write down that fake number and later send a probe to it. Since the fake house didn't actually exist, the only way a probe could reach it was if the clock (or someone connected to it) had saved the number and was actively looking for it.

What They Found

Over the course of a year, the researchers sent about 2.45 million of these fake requests to 2,335 different NTP servers. They found that 22 of those servers were indeed acting as spies. These 22 servers were grouped into four distinct "clusters" of behavior:

1. The Light Touchers: One group of servers mostly just sent a single "ping" (a basic check to see if the device is alive) to the fake addresses. They were curious but didn't dig deep.
2. The Heavy Hitters: The most active group, which the researchers dubbed Cluster 2, was a massive operation. They used 8 NTP servers to collect addresses, but then launched a huge scanning campaign using over 3,000 different IP addresses to knock on doors. They didn't just check if the door was open; they tried 572 different types of locks (TCP ports) and 9 different types of keys (UDP ports). They were looking for specific things like web servers, remote control tools, and databases.
3. The Lone Wolves: Two other groups were much smaller, with just one server each, but they were still scanning. One sent pings, and the other tried to access a specific Android debugging port.

The researchers noticed something interesting about the timing. For the "Light Touchers," it took about 14 hours on average to start scanning after seeing a new address. The "Heavy Hitters" took a bit longer, about 22 hours, but once they started, they didn't stop. Some of these scans continued for over a month, repeatedly checking the same addresses.

The "Why" and the "Who"

The researchers tracked down the owner of the biggest scanning group (Cluster 2). It turned out to be a cybersecurity insurance firm. When the researchers asked them about it, the firm was forthright: they admitted they were using the NTP Pool specifically to learn active IPv6 addresses for the purpose of back-scanning. They claimed they did it for "defensive purposes," specifically to help calculate risk for their insurance clients. They argued that knowing what devices are out there helps them understand the threat landscape.

However, the researchers pointed out a major problem: the people whose devices were being scanned didn't know it was happening. Most of these devices are small, embedded gadgets (like smart thermostats or IoT sensors) that just automatically ask the NTP Pool for the time. They never agreed to be scanned. Furthermore, the scanning firm was using a mix of cloud servers that were hard to identify. While the firm admitted that about 40% of their scanning infrastructure was missing identification records (rDNS) and claimed they had fixed those specific entries, they did not add identification records to their NTP servers. Additionally, neither their NTP servers nor their scanning servers host a webpage to explain who they are or how to opt out, though a redirect on their domain does provide some information.

The Aftermath

This discovery highlighted a "gray area" in internet ethics. While knocking on a door to see if someone is home isn't usually a crime, doing it secretly using a trick to find addresses that were supposed to be hidden is ethically murky. The researchers didn't just point out the problem; they started working with the NTP Pool administrators to fix it.

They are currently building a system to integrate their detection method directly into the NTP Pool's scoring system. In the future, if a volunteer clock server is caught "back-scanning," the system will automatically lower its score, meaning it will stop getting traffic and eventually be kicked out of the pool. The researchers also shared a list of the bad actors with the NTP Pool, and the insurance firm involved agreed to make their operations more transparent by correcting the missing identification records on their scanning servers, though the NTP servers themselves remain unidentified.

The Takeaway

This paper shows that even in a world where finding devices is supposed to be hard, there are clever ways to cheat the system. By using the trust placed in a volunteer timekeeping service, some entities were able to build a map of the internet's most elusive devices. The study suggests that while these scans might be intended for security or insurance, they bypass the consent of the device owners. The solution isn't to shut down the NTP Pool, but to make it smarter, ensuring that the volunteer clocks remain just that—clocks—and not secret spies.