Is publishing your public IP address a security threat?

Question

I work for a large-ish company (thousands of employees across multiple locations). I recently needed to know what the possible public IP addresses are, so that a vendor could identify us (presumably for their firewall).

The network guy I spoke with acted as if anyone knowing our range of public IP addresses is a significant security threat. A few of the IP addresses in that range are totally public, being resolved from our public web site domains. What is the real risk of having the whole world know all the possible IP addresses that you might have?

Answer 1

Your public facing IP address is for most intents and purposes public information. No security should be dependent on it being private, however it's not something you want to wave around willy nilly necessarily (just like you wouldn't wave your home address around) but it also isn't something that is hard for someone to find with generally minimal effort if they know what they are doing.

If someone has a legit need for your IP address though, there is no reason that it should be a security red-flag. Your public IP address is disclosed to every system you talk to on the Internet by necessity.

Answer 2

Your network guy might have a good reason for not wanting to share the information you enquired about. You see, what you describe you asked him of is not the IP range (CIDR) your company has been assigned to, but actual list of individual live IPs within that ASN. Now, getting the CIDR range that your organisation was assigned to its ASN is relatively easy, provided you know of a single IP belonging to that organisation and then simply search through all the registered ASNs. Alternatively, even searching for organisation's name might yield relevant ASNs it uses - see for example my answer for the How to get info on company , company owned sites etc… question. Much of this data is public knowledge.

That said, I believe you would get a completely different response, if you asked him of the CIDR range your company was assigned to, which is hardly a secret but probably good enough to assign new rules to a firewall. Sharing actual list of live IPs is a different matter tho;

Imagine your company has a /24 range of public IP addresses (CIDR) assigned to its network (its ASN). That's only 256 IPs and quite common for smaller organisations. Now, let's assume your organisation really only uses half of these IPs, and the other IPs are dead. How could keeping this a secret serve your network guy? Let's assume an attacker wants to scan the CIDR range your organisation uses to collect server banners (software, hardware, operating system's identifying information or signatures) and enumerate live IPs. That's usually among the first steps an attacker would make. He'll go through the list of all IPs in your CIDR range, leaving fingerprints in access logs of various networking devices your network guy's setup. Your network guy can then easily determine what external IP was scanning your network's whole CIDR range worth of IP addresses (an attacker would scan all of them, including dead ones, while a legitimate user would only be accessing live ones) and promptly blacklist attackers IP to protect the network. Easy. If however the list of live IPs somehow became public (i.e. shared with an untrusted 3rd party), the chances an attacker creates this obvious attempt trail quickly diminish.

I think you should go back to your network guy and rather ask him for your public IP range next time. He shouldn't have much problems sharing that and is sufficient information 3rd parties need to know to whitelist your IPs, or otherwise identify access through them for other purposes, like e.g. automated client identification for extranet B2B services and alike.

Answer 3

A public IP address is called a public IP address for a reason. Treat it like one.

Keeping the list of public IP addresses belonging to your company will make no difference to any sort of attacks, be it opportunistic or targeted. If your system is connected to the internet, it will be hammered on by automated scripts and malware out there. If an attacker is directing a targeted attack against your company's network, keeping that list of public IP addresses secret will not pose much of a barrier.

Don't rely on obscurity to protect your networks. Assume that every attacker knows that information and much more and work to protect your networks properly.

Answer 4

Knowing which IP exist at all in a network can be some valuable information for an attacker, if the organization owns a full range of IP addresses but actually uses only a few of them. The idea being that if there are 10000 addresses to choose from, but only 20 with actual machines behind them, the attacker may spend some time trying to reach inexistent machines.

Of course this is not a realistic scenario. It used to be true, when the range of possible IPv4 addresses was plentiful and any university or corporation could obtain a B class (with 65536 addresses). But not anymore. The End of Times is Nigh.

However, you could want to avoid attracting attention on your network. Competent attackers who target your network will learn your IP addresses. But there are also a lot of incompetent attackers, who can become a nuisance by their sheer numbers; some minute level of discretion can be sufficient to deter them. Not publishing your IP addresses is like not putting a bronze plaque at the entrance of your business headquarters.