Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar list?

  • How effective would this in thwarting DDoS or black hat/covert activities?

  • How would I implement such a solution? (I'm open to free or paid solutions here)

Edit

Assume that the users of this web site (or other network resource) should not be anonymous. This could either be by company policy, in the terms of service, etc.

This is an exercise in limiting risk for the service provider.

share|improve this question
1  
What you want to do is not possible. If it were then TOR would be useless because everyone would block it. If this a website that is designed to be only accessed from the internal network for a comapny it is possible. The simple solution to to block every address except the internal ip addresses you assign. – Ramhound Mar 19 '12 at 13:08
    
@Ramhound, we can just block all the TOR exit nodes right? – Pacerier Jul 17 '12 at 20:35

My first thought is that if it's a DDoS attack, the source is most likely going to be infected zombie machines that the operator could care less whether they're traceable because they won't lead back to him. I'm sure a good number of black hat users use Tor to try and cover their tracks, but I'm also willing to bet there are more legitimate users on Tor than not. So essentially you could block all Tor traffic, but in the end you might end up blocking more good guys than bad guys.

share|improve this answer
    
I updated the question... assume part of the Terms of Service or Corporate policy is that TOR must not be used. – LamonteCristo Mar 16 '12 at 14:39
1  
@Safado, why does legitimate users need to user Tor in the first place? – Pacerier Jul 17 '12 at 20:36
1  
Do you honestly think that only bad guys use Tor? – Safado Jul 17 '12 at 22:48
3  
@Pacerier, why do we need laws against random police officers searching random houses without any reason at all other than "You do not have anything to hide, do you?" Using Tor for legitimate purposes is good because it makes the usage of Tor less of a red flag. If Tor was only used for illegal tasks (such as reporting of human rights violation, circumventing censorship by the USA or their own countries), the risks would be even higher. – Hendrik Brummermann Aug 10 '12 at 6:27

A serious attack would swamp your ISP, so your local solutions would be irrelevant. Your ISP might cut you off and/or expect you to pay outrageous excess bandwidth fees.

Even one determined attacker can cause a lot of problems for a site that runs on ordinary hardware, so preparing defenses based on blocking particular IP addresses is still worthwhile.

You should also note that what you perceive as an attack is more likely just a misconfigured web crawler or other relatively innocent program misbehavior. That's good, because simple blocking is likely to be effective.

share|improve this answer

I would like to encourage you to take a look at the following links:

The TOR project has an entire FAQ page concerning abuse including a section called "I want to ban the Tor network from my service." where they elaborate on how to identify and block TOR exit nodes and what alternatives there might be to doing so.

Also there are currently 400k people using TOR, the USA being #1 with around 14% (60k). This might have a bad impact on your company's image. ("They are contra-privacy!" "They are in favour of warantless wiretapping!", ...)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.