Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar list?

  • How effective would this in thwarting DDoS or black hat/covert activities?

  • How would I implement such a solution? (I'm open to free or paid solutions here)

Edit

Assume that the users of this web site (or other network resource) should not be anonymous. This could either be by company policy, in the terms of service, etc.

This is an exercise in limiting risk for the service provider.

share|improve this question
1  
What you want to do is not possible. If it were then TOR would be useless because everyone would block it. If this a website that is designed to be only accessed from the internal network for a comapny it is possible. The simple solution to to block every address except the internal ip addresses you assign. –  Ramhound Mar 19 '12 at 13:08
    
@Ramhound, we can just block all the TOR exit nodes right? –  Pacerier Jul 17 '12 at 20:35

4 Answers 4

My first thought is that if it's a DDoS attack, the source is most likely going to be infected zombie machines that the operator could care less whether they're traceable because they won't lead back to him. I'm sure a good number of black hat users use Tor to try and cover their tracks, but I'm also willing to bet there are more legitimate users on Tor than not. So essentially you could block all Tor traffic, but in the end you might end up blocking more good guys than bad guys.

share|improve this answer
    
I updated the question... assume part of the Terms of Service or Corporate policy is that TOR must not be used. –  makerofthings7 Mar 16 '12 at 14:39
    
@Safado, why does legitimate users need to user Tor in the first place? –  Pacerier Jul 17 '12 at 20:36
1  
Do you honestly think that only bad guys use Tor? –  Safado Jul 17 '12 at 22:48
1  
@Pacerier, why do we need laws against random police officers searching random houses without any reason at all other than "You do not have anything to hide, do you?" Using Tor for legitimate purposes is good because it makes the usage of Tor less of a red flag. If Tor was only used for illegal tasks (such as reporting of human rights violation, circumventing censorship by the USA or their own countries), the risks would be even higher. –  Hendrik Brummermann Aug 10 '12 at 6:27

I would like to encourage you to take a look at the following links:

The TOR project has an entire FAQ page concerning abuse including a section called "I want to ban the Tor network from my service." where they elaborate on how to identify and block TOR exit nodes and what alternatives there might be to doing so.

Also there are currently 400k people using TOR, the USA being #1 with around 14% (60k). This might have a bad impact on your company's image. ("They are contra-privacy!" "They are in favour of warantless wiretapping!", ...)

share|improve this answer

If your looking for a solution to limit the amount of rouge traffic visiting your website then I would recommend using Cloudflare, they have a free solution and subscription packages. Here's an link below.

https://www.cloudflare.com/overview

As for blocking traffic from Botnets, that's really not going to be worth your time, Botnets are distributed meaning that there is going to be many thousands of IP's trying to visit your website and because all of the IP Addresses accessing your site will come from hacked PCs they just look like ordinary visitors. This is why using Cloudflare could come in handy cloudflare routes all traffic to your website to filter it. They do this by checking large lists of malicious traffic so see if those visitors have been involved in previous DDoS, Spam or hacking attacks.

share|improve this answer

A serious attack would swamp your ISP, so your local solutions would be irrelevant. Your ISP might cut you off and/or expect you to pay outrageous excess bandwidth fees.

Even one determined attacker can cause a lot of problems for a site that runs on ordinary hardware, so preparing defenses based on blocking particular IP addresses is still worthwhile.

You should also note that what you perceive as an attack is more likely just a misconfigured web crawler or other relatively innocent program misbehavior. That's good, because simple blocking is likely to be effective.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.