Block all BotNets and TOR addresses from accessing our site

Question

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar list?

• How effective would this in thwarting DDoS or black hat/covert activities?

• How would I implement such a solution? (I'm open to free or paid solutions here)

Edit

Assume that the users of this web site (or other network resource) should not be anonymous. This could either be by company policy, in the terms of service, etc.

This is an exercise in limiting risk for the service provider.

Answer 1

My first thought is that if it's a DDoS attack, the source is most likely going to be infected zombie machines that the operator could care less whether they're traceable because they won't lead back to him. I'm sure a good number of black hat users use Tor to try and cover their tracks, but I'm also willing to bet there are more legitimate users on Tor than not. So essentially you could block all Tor traffic, but in the end you might end up blocking more good guys than bad guys.

Answer 2

I would like to encourage you to take a look at the following links:

The TOR project has an entire FAQ page concerning abuse including a section called "I want to ban the Tor network from my service." where they elaborate on how to identify and block TOR exit nodes and what alternatives there might be to doing so.

Also there are currently 400k people using TOR, the USA being #1 with around 14% (60k). This might have a bad impact on your company's image. ("They are contra-privacy!" "They are in favour of warantless wiretapping!", ...)

Answer 3

If your looking for a solution to limit the amount of rouge traffic visiting your website then I would recommend using Cloudflare, they have a free solution and subscription packages. Here's an link below.

https://www.cloudflare.com/overview

As for blocking traffic from Botnets, that's really not going to be worth your time, Botnets are distributed meaning that there is going to be many thousands of IP's trying to visit your website and because all of the IP Addresses accessing your site will come from hacked PCs they just look like ordinary visitors. This is why using Cloudflare could come in handy cloudflare routes all traffic to your website to filter it. They do this by checking large lists of malicious traffic so see if those visitors have been involved in previous DDoS, Spam or hacking attacks.

Answer 4

A serious attack would swamp your ISP, so your local solutions would be irrelevant. Your ISP might cut you off and/or expect you to pay outrageous excess bandwidth fees.

Even one determined attacker can cause a lot of problems for a site that runs on ordinary hardware, so preparing defenses based on blocking particular IP addresses is still worthwhile.

You should also note that what you perceive as an attack is more likely just a misconfigured web crawler or other relatively innocent program misbehavior. That's good, because simple blocking is likely to be effective.