4

I am responsible for securing an AWS environment and am noticing various recon attacks against the environment. We have the option of blocking the IP addresses in our firewall, but the environment is scanned with different attacks multiple times a week (i.e., management of this is not simple). This environment is mostly for B2B and does not host a great deal of traffic, so my thought would be that we should block away.

I would think for other environments that are very high in consumer traffic, blacklisting IPs may not be the best idea because, as we know, IP addresses can change frequently and be assigned to non-malicious users. We wouldn't want to block a potential customer from our website.

A follow up question would be, is it best practice to then remove these blacklisted IPs after some time in case they no longer are associated with an attacker?

jay-charles
  • 1,209
  • 1
  • 11
  • 14
  • You can get lists of c2 servers and other IPs that have a reputation for serving malicious content. They are generally published 2 to 3 times a week depending on the source, if you create a blacklist and populate it with the latest list then you will cut down on a lot of the door rattling and mitigate against various other risks. – TheJulyPlot Nov 30 '15 at 19:33
  • 1
    Isn't the answer quite peculiar to the site? As you state, B2B leads to a different answer than customer focused. Each customer is going to have to make a risk based decision. There is no silver bullet. Do you monitor the IP's after you have blacklisted them? Would it make sense to drop the block after the threat vanishes? – MCW Nov 30 '15 at 19:40
  • Blocking servers should be okay. There are many hosting companies abused for attacks, block them. – Daniel Ruf Nov 30 '15 at 20:39

2 Answers2

10

In order to answer your timing question it's important to understand how blacklists really help you. Blacklists are a great way to slow-down attackers and work great when triggered appropriately. Even a 30-minute blacklist can really have a huge impact against any type of automated attack. There are tools like fail2ban (link below) which can easily help you automate your blacklisting based on malicious behavior. Likewise there are tools like ipset (link below) which can be used with iptables to create large black-lists or white-lists than can easily block or allow tens of thousands of IP's with almost no impact on performance.

But back to your question on timing. Every site will have different needs and different requirements but as a general rule of thumb I group who I blacklist into three categories.

1.) IP's that will never have a need to connect to these systems

2.) IP's that are doing really targeted harmful stuff to these systems

3.) IP's that are scanning or doing something less harmful but are still annoying and may include a customers infected system.

and based on these groups (yours may be different) I set a variety of different block times. In this example I use the following block times based on the groups above.

1.) Forever

2.) 24-168 hours

3.) 30-60 minutes with 30 minutes being the most common.

This said I would also take into context what activity you are blacklisting. If an organization has a public website but I see attacks brute-forcing secure-shell or a VPN server (something that is NOT meant to be accessible to the general public) I don't mind blocking that type activity for much longer on that port or protocol. Likewise if I see an IP address really hammering a site with tens of thousands of attacks or repeated activities for days that IP gets blocked for a longer time.

So in some sense there is no cure-all answer to your question but I do see lots of very large name-brand companies blocking for at least 30 minutes to disrupt the automated attacks and I highly recommend doing this because it gets rid of a lot of the brute-force scanning that ultimately effects all sites.

Note: With the #2 group it is also wise to send an abuse e-mail to the bad actors ISP CC'ing the IP owner and/or domain owner. Frequently this helps resolve the problem after a few days and if not you can always promote that IP to group #1 if you have too.

Finally I would also recommend creating a white-list of your infrastructure and also of your key business partners or critical clients. Occasionally business partners do check the security of their supply chain and you may not want to auto-block these organizations if they decide to take a closer look at what you are doing.

I think it is very wise to actively blacklist bad actors especially since it's a very cost-effective defense but I wouldn't limit your blocking to a single type & time-frame if you can avoid it. That said if you do, 30-minutes seems to be the industry norm right now.

http://www.fail2ban.org/

http://ipset.netfilter.org/

http://ipverse.net/ipblocks/data/countries/

Hope this helps.

Trey Blalock
  • 14,099
  • 6
  • 43
  • 49
  • Great response! One question that I do have is the difference between #1 and #2 in your blocking categories. Wouldn't your #2 also fall under category number 1 and should be blocked indefinitely? Why would you ever have a need to connect to IPs that are doing very harmful activities to your systems? One other point I wanted to bring up is -- what about changing IP addresses? Is there not some probability that an IP that is blocked is then assigned to a non-malicious actor? There is risk of blocking a customer (at least in B2C systems), no? – jay-charles Dec 01 '15 at 13:24
  • The difference between #1 and #2 is more a policy decision than anything. There are cases where the ones in group #2 do get promoted to group #1 (badactor won't stop) but generally I find that if I check it each week or contact the upstream ISP the automated attacks do generally stop at some point and frequently the systems are owned by an unknowing third-party not the bad actor directly. – Trey Blalock Dec 01 '15 at 18:41
2

You could always create a white-list of IP addresses or domain names validation like only accept from .example1.org or .example2.org. Either the domain name or the ip address. Black lists are bad because and attacker could use a different IP address. (i.e. tor or a bot net) managing that list would be a nightmare. A white list make it easier as you don't have to manage black listed ip addresses but if you have different businesses hitting you call the time that could be a nightmare as well.

bdawg
  • 187
  • 12