Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So i had a debate recently where one of my colleagues believed that by launching a penetration test (one requested by our clients) from our one of our IP's we could potentially get that IP/all IP's in our block banned.

We are signed up with an ISP that allows for this kind of activity on our link (as long as its legally done), so my question is, do ISP's have the ability to detect and blacklist attack traffic on their networks? Do end-point 'client' firewalls have the ability to blacklist IP's not just on their firewall but to 'report it back' to some central server somewhere which will blacklist our IP across the world (to anyone using that blacklist)? I know such blacklists exist for Spam sources but i'm not sure about attack traffic.

Note:

  • We are not using any bandwidth intensive attacks (like DDoS attacks which would adversely affect ISP traffic)

Hope someone can help! Thanks

share|improve this question
    
"We are signed up with an ISP that allows for this kind of activity on our link (as long as its legally done)..." If it's allowed, why are you worried?.. –  Terry Chia Feb 14 '13 at 9:12
    
I think he's referring to the client's ISP. –  g3k Feb 14 '13 at 14:45
1  
@g3k Yes. But also the wider internet. –  NULLZ Feb 15 '13 at 6:01
add comment

1 Answer

up vote 5 down vote accepted

Detecting the attack traffic from a penetration test requires deep packet inspection. DPI is very expensive to implement on an large level and doesn't directly generate revenue.

Common uses of DPI by ISPs are:

  • Lawful intercept. This is mandated by authorities and is targeted.
  • Targeted advertising. $$$
  • Quality of service. Generates revenue by offering good QoS.
  • Offering tiered services. Also revenue generating.
  • Copyright enforcement. Mandated or paid.

One way for an ISP to enforce an acceptable use policy is to perform DPI on a statistically meaningful sample of the traffic.

Do end-point 'client' firewalls have the ability to blacklist IP's not just on their firewall but to 'report it back' to some central server somewhere which will blacklist our IP across the world (to anyone using that blacklist)?

Unified threat management products are able to centrally manage alerts and push derived rules across the network.

share|improve this answer
    
The key thing i am after is not if i'll be blacklisted by the target client network, but if, by being blacklisted by a corporate network, i will, in turn, be blacklisted by a 'blacklist feed' for example www.spamhaus.org. –  NULLZ Feb 14 '13 at 10:23
    
Some businesses run SPAM traps and honeypots in the internal network/DMZ that automatically send malware binaries and source IP addresses to spam/malware collecting websites. –  Cristian Dobre Feb 14 '13 at 13:22
    
@Christian client run Honey pots for example, if i don't deploy any malware. Will they potentially add me to a blacklist somewhere? –  NULLZ Feb 15 '13 at 6:03
    
You could be bruteforcing an SSH login or exploiting a honeypot service and then be picked up by the trap. –  Cristian Dobre Feb 15 '13 at 9:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.