I received an email earlier today from my ISP (a university). The email reads (in part):
Your network connection has been disabled because your version of Java is not patched for the most recent security vulnerabilities. This leaves your computer open to attack. If these vulnerabilities are not patched, your computer could come under the control of a hacker.
I don't have Java installed on my machine at all, so this seemed like an obvious false positive. I contacted them and received a reply stating that:
Our system automatically detects these vulnerabilities, and false positives are rare.
So it seems that they are running automated scans against hosts on the network to try to identify old versions of Java (and probably other software). It seems strange that I would be identified since:
I block all incoming traffic except ICMP and port 22 (SSH); tests performed after the incident confirm that the firewall is functioning as intended both on LAN and WAN
All of my internet-bound traffic is routed over an encrypted OpenVPN tunnel to a remote server. I confirmed after the incident that all traffic, including DNS, is being routed through this tunnel (as intended).
In the interest of avoiding future false positives, what kind of methods are typically used for these kind of automated vulnerability scans? My interest is specifically regarding software like Java which does not run in the background or act as a server.
My system is running Debian stable. No JDK or even JRE is (or has ever been) installed on the system.
The ISP is in a position to monitor all traffic or run scans, but not to access my computer in any way. I have never installed any software from the ISP or been asked to.