For folks only looking for a cautionary tale, who don&#x27;t worry about larger security trends and only want to keep their own machine safe, that&#x27;s a fine takeaway.<p>For people who do care about network security, it is a very interesting post for a few reasons.<p>If someone is harvesting IPs from NTP queries sent to Debian infrastructure for intelligence gathering, that in itself is a big deal.<p>It is also a somewhat novel technique - if an attacker is placed such that they can see the first NTP queries sent by a new install, they are well placed to target that device before it is fully hardened&#x2F;patched, because they likely see some of the first packets sent by that install. It is really rather clever.<p>It also points to the sort of correlation we need to be getting better at - orchestration isn&#x27;t just for devops weenies anymore, and this sort of thing is only going to become more sophisticated.<p>I&#x27;ve been noodling about with making a tool for making this sort of analysis easier, but there are a number of problems to fix, not least of which is the sheer volume of data generated watching the wire, even on my home network (which is a bit absurd for your average home, but tiny compared to a business of any size).