Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A Chinese IP address shows up in our logs as accessing one of our surveys but it stands out because the user tried adding a string to the end of the survey's URL (as if trying to perform a SQL injection attack).

Because the whois lookup for the IP address is from China it seems practical to block the entire IP range. We do have one client in Hong Kong but their surveys are aimed at business users from Singapore, Australasia and USA more than China itself.

Is it better to block the IP address or leave it open?

share|improve this question
    
"survey" = "server"? –  Dennis Williamson Sep 4 '09 at 12:27
    
Dennis: I would guess that the application is for doing surveys ? –  Kyle Brandt Sep 4 '09 at 12:34
    
I do mean "survey" –  Dan Sep 4 '09 at 13:37

9 Answers 9

up vote 6 down vote accepted

Depends, again.

If you block the IP, it's not hard to just change the IP.

If you block the range, you get a lot of collateral damage from people who can't get in but were innocent. Doesn't stop a lot of people from still blocking country ranges of IP.

If you have a select number of clients that are getting access to the site in question...it's a semi-private database, for subscribers only, etc...you can just block access to all but accepted whitelists to that portion of the site only.

Otherwise you would need to keep updated, updated, updated, and periodically have your code audited by outside contractors for injection attacks and other hazards, and probably have something like Tripwire installed on the server to watch for suspicious changes and alterations on the server (and keep good offline backups. More than a few sites have had "live" backups that suddenly get hacked or erased once entry has been gained to the network).

In my experience blocking specific sites and hack attempts is messy and doesn't necessarily stop the problem. If it's a repeated hit over and over you could look at a solution that sees problematic slamming of your site and have it automatically blocked for a period of time (kind of like denyhosts for SSH) so it's kind of a transient, "enough already" blocks that don't clutter your system forever. It's just too easy for scripted attacks to hit from the left one day then appear on the right the next, and you'll end up running in circles chasing your tail trying to stop these idiots.

Make sure your server is secured off your LAN, segmented to prevent a hack on that system from contaminating the rest of your network. Audit it. Watch the logs for suspicious activity. Block only really problematic IPs (like denial of service attacks) at the router. Otherwise...my vote is that it's a hassle to stop them unless you have some automated way to track it and a way to automatically remove it after a period of time.

share|improve this answer

If it appears not to be bot, you could take advantage of this. You could set up another server with dummy data, redirect to that based on the source IP, and watch them hack it. Companies pay for penetration testing, as Bart said with "Code Audits". So if the hacker manage to get through, you can submit that to the developers, and you just got free work from the hacker :-)

Never done this myself, but if you have the time / resources, might be fun...

share|improve this answer
1  
Props to anyone who can tell me if that strategy is in the Art of War, and how is it expressed ;-) –  Kyle Brandt Sep 4 '09 at 12:07
1  
The Art of War has a chapter on "_h_ts and Giggles"? –  Bart Silverstrim Sep 4 '09 at 12:15
1  
This is called a honeypot - a server you put out there to look like a better, more vulnerable target to hackers to take their attention away from your prod servers. Could even "accidentally" leak an internal hostname like "FINANCESERV" or something that looks worth hacking while they are probing your IP range to get them to focus their attention on it. Be careful with this strategy though as you may end up drawing too much unwanted attention and use up bandwidth that should be taken by your regular customers. It is also VERY important to isolate the honeypot from the rest of your servers. –  August Sep 4 '09 at 14:52
    
August: I thought a honeypot is a bit different, as it is an 'easy' target. I recommened that he use a copy of the actual server with different data to see if there are any holes, not setting up some sort of easy target. –  Kyle Brandt Sep 4 '09 at 17:40
    
It's as easy a target as you want to make it. Its main purpose is to "appear" to be much more attractive than your production servers - more worth the hacker's time/effort to get into whether it be easy or hard. I'm not sure about using the exact same config to see if they can hack it, because lets say they do...Well there is another server there with REAL data that has the same vulnerability so let's try to get into that - oh look I can... –  August Sep 10 '09 at 19:41

I wouldn't block the IPs manually. I might however, set up a fail2ban script to programatically block user's IPs for a short amount of time, based on the apache logs (I'm assuming you're using linux. Substitute your OS, and script of choice). It's not perfect security. It just makes life a tiny bit harder for the bad guys, at little cost to yourself.

share|improve this answer

I think its good practice to regularly audit your logs. Some people dont even do that.

I agree with all advice here. Blocking the IP probably wouldnt hurt, but you cant really block EVERY IP that some bot tries to connect from....I've tried that. I suppose if its not a bot, then block it. Maybe it will send a message. You cant really be sure what resources are at the other end.

I would say pay careful attention to your logs (obviously). Make sure your machine is updated. Also, make sure you have a backup in case something horrible happens.

share|improve this answer

Many of the alternative solutions given above on securing and monitoring your servers would be better use of time than simple bans, especially for IPs from China. All the major telecoms(there's really essentially two, but I digress) offer broadband service with dynamic IPs for just about all home and small to medium businesses. Unplugging and replugging a router is all it takes to switch over to an IP that's not blocked.

Also, in a country with such a restrictive policy on the internet, you can be pretty sure that anybody savvy enough to be trying to attack or hack a server is familiar with and most likely regularly makes use of proxies and other methods of tunneling or relays, and would barely be affected by a simple IP ban, even if they were operating from a static IP.

Also, having lived in China for the last X years, it's really annoying to try and load a page and be told the IP has been blocked for abuse because some douche-bag who had the IP earlier didn't have anything better to do. Blocking entire IP ranges without a strongly backed up reason always seemed a bit extreme to me.

share|improve this answer

My personal opinion? Blocking won't help!

Basically, when blocking IP's becomes company policy then you'd get a false sensation os security, because you think you're blocking the bad guys. Reality? Bad guys know how to switch to other systems and thus other IP addresses while the IP address they mis-used will just continue to be blocked. If that IP address happened to be linked to a legitimate user then that user would be blocked, while the hacker just uses another gate to get in your site.

No, if a hacker tried to hack your site, check if he succeeded in his attack. Try to replay his attack if possible. And if he was successful, you should patch the leak in your server, not block the hacker. To be honest, hacking attempts can be useful to your site to show how secure it is. If you get hacked then your security wasn't good enough and you should blame your own technical staff, not the hacker who attacked you.

You won't stop hackers by blocking their IP address. Sooner or later you end up blocking half the Internet...

share|improve this answer
    
Blocking does help, depending on your needs. A wiki I run occasionally gets spammed. I can either block the address and clean up the mess once, or leave things as-is and clean up the mess repeatedly over the next few days, weeks, or months. At any given time there are between 0 and 20 addresses in my blacklist. Certainly not half the Internet. (I'm using the "blacklist" utility from apachesecurity.net/tools so the entries time out after a while.) –  Gerald Combs Sep 4 '09 at 16:32
    
Blocking for a short time is more effective than a permanent block. Then again, many forums won't allow a visitor to post new messages within a certain amount of time since their last message. Often just a matter of seconds. Other forums will also allow only a certain amount of posts per member, also to avoid spam. However, who is going to stop a spammer who will misuse a spambot network to DDOS a popular forum full with spam messages? Blocking won't even help in that case. A better design of the web page might be more effective since it has a flaw that allows misuse. –  Wim ten Brink Sep 7 '09 at 8:27

My policy is that if the source is causing performance problems or has managed to actually find a hole (hosting other people's shoddy sites has it's disadvantages) then it gets blocked, otherwise let them beat their little brains out, fly style.

share|improve this answer

Here are some guidelines:

You should keep your internet facing servers up to date, audit your scripts, use security zones, jails, chroots where applicable, use an something like tripwire to audit changes and maybe a IDS on a spanning port (it 's up to you to make good correlation of what's happening there as an attacker may flood your IDS hiding the real attack.)

Blocking just an ip may be just a wasting time under a real attack scenario.

Hope this helps.

share|improve this answer

Do not block entire IP addresses from another country, just because they're from another country, and you don't care so much. That's potentially racist. At the very least, it's not in keeping with the open, peer-based, global community that is The Internet.

The best thing to do is:

  • Block them temporarily

  • Find out who's responsible for abuse on that network with:

    whois the.abusers.ip.addr | grep -i abuse
    
  • Email them, making it clear that you expect this to be dealt with quickly, or you'll be taking it to THEIR ISP, one tier up. Add that you'll be blocking their ENTIRE RIPE allocation too, if you own a network / customers big / important enough that it'll make a dent.

    • Assuming it gets sorted out, thank the OrgAbuseEmail guys, and remove the block. Otherwise, implement the threat, report the ip / network to spam filters, etc.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.