Someone scans the internet for NC/OC instances

[JasonBayton]

I don’t understand why you can’t see past your own opinions here. The “service” (I’ll call it that) is great, and on par with what Google did recently with my Wordpress install that’d already been patched before they contacted me.

But therein itself lies an issue. I patched my Wordpress install the day the vuln was disclosed and the patch was provided. Google scanned it some time during that day and saw it hadn’t yet been patched so queued a notification to go out to me.

The same can happen here, except instead of me, the admin, being notified (by which I’d say thank you and perhaps even shout out the value of that service), I’d get a cease and desist type letter (as an ISP will often consider these alerts a complaint. They’re not smart.) 2 weeks later - by which time I’m on their radar for potentially doing something I shouldn’t. This puts my internet contract under threat.

There’s a distinction here too; this notification sent to a datacentre will be handled in a completely different manner to the ISP of a home user - a vast userbase for these solutions.

I applaud the objective, and I fully support everyone being up to date within the constraints applied (see patch schedules, etc mentioned above), but the communications protocol in place is all wrong.

The proof of this is in the very existence of this topic.

[tflidd]

@jurgenhaas

potential thread they recognized is imposed from the ISPs properties and that’s why they get informed and asked to do something about it.

All outdated software cause a potential threat (browsers, flash, …) but ISPs will have to constantly sending notification letters to their customers if you want to set this as a standard. A list of IP addresses of clients of a bot network is a real threat and not only a potential one. From https://nextcloud.com/security/advisories/ I don’t see a warning where you can obtain root-permissions on a system. For me it seems exaggerated, especially when some could have been contacted via whois data as @JasonBayton pointed out.

For the community/developers here, there are much better ways to make sure/help users to keep their systems up to date.

[jurgenhaas]

@JasonBayton

but the communications protocol in place is all wrong.

Well, if the topic turns into the question who the BSI should best contact if they got aware of some issues, then this should probably discussed somewhere else. Don’t you think?

@JasonBayton

an ISP will often consider these alerts a complaint. They’re not smart.

If that’s true and the online service are of any importance to you, I’d consider changing the ISP.

Guess what, ISPs have to handle that sort of stuff 24/7 and they really know how to handle these. If they don’t, they are not the right service provider.

@tflidd

All outdated software cause a potential threat (browsers, flash, …) but ISPs will have to constantly sending notification letters to their customers if you want to set this as a standard.

Yes, and not only ISPs. When ever someone gets to know about a vulnerablity they should responsibly disclose that to someone who can deal with it. There is no reason to downplay any of that - but at the same time I can’t tell why there is a smell of panic in the air.

My original post was about an abservation and I asked a question because I wanted to understand what’s going on. That’s achieved and the advise is probably best we all can/should do:[quote=“jospoortvliet, post:36, topic:8992”]
so those attempts could have been from anywhere in the world and I think it is a good move to block them
[/quote]

[JasonBayton]

@jurgenhaas

then this should probably discussed somewhere else. Don’t you think?

No, as it’s a service being conducted on behalf of Nextcloud, their involvement shown in the links to results and contacts provided. NC should have some say into how this service is provided, or switch to a provider of said service that doesn’t conduct its communications in this manner.

@jurgenhaas

If that’s true and the online service are of any importance to you, I’d consider changing the ISP.

I wouldn’t consider changing my home ISP over this. It’s an edge case and something that shouldn’t involve the ISP at all.

@jurgenhaas

there is a smell of panic in the air

Reading through it appears to be less panic and more concern/disdain for how this is being handled, which is justified. Applying enterprise policies to home admins is rarely going to be the right approach.

You’re right though, NC is still not going to divulge any more information or offer any transparency in what should be an open, friendly service. So those who don’t like the idea of having their ISP involved where they have no reason to be, blocking the IPs is the way to go.

I’ve set this to autoclose now. If @tflidd or another moderator feel there’s more to be said feel free to re-open it when it closes, similarly non-mods feel free to message me, but it appears to be going around in circles (which is as much my fault as anyone else, sorry).

[jospoortvliet]

Let me add that we have now talked about this publicly. You can get answers to your questions in our blog.

Thank you for caring about this! I hope you can help urge people to update their servers.

Sorry that being a bit secretive about this has led to some issues. This was done to protect the vulnerable installations out there and give people time to update. It’s standard security best practice, and working with the country’s Computer Emergency Response Team’s and the Shadowserver foundation team is the proper way to deal with this – which is why we did it that way.