Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ones too. So far I have come across dshield (Internet Storm Center) and i-blocklist. What are others that I can consider that you have used and found useful?

The main aim is to prevent against DDoS. Being able to block TOR and anonymous proxies via the feed will also be nice.

share|improve this question
1  
Are you a network administrator, and can configure the border routers in your AS? –  Dog eat cat world Aug 2 '11 at 8:40
2  
I think it may be more useful to use hueristics to configure your routers and firewalls than a attempt to monitor and block a very large list of ip addresses that are subject to change. –  this.josh Aug 2 '11 at 21:21

4 Answers 4

Related to @M'vy's answer, you should look at TorDNSEL

"TorDNSEL is an implementation of the active testing, DNS-based exit list for Tor exit nodes."

share|improve this answer

You can find links to the TOR exit node list with a quick google search. The Spamhaus XBL is a great resource and I would likely utilize sinkholes and other options for blocking DoS attacks. But as I was recently tasked with creating a rather large list of ip's and domains related to malicious activity for another purpose whether it be botnets, spammers, malware payloads, exploit kits and DoS attacks. A good starting resource would be Lenny Zeltser's list you can find here although its become a bit dated many of the sources are still alive. http://zeltser.com/combating-malicious-software/malicious-ip-blocklists.html

A few websites attempt to roll up all malicious domain's and ip's into lists, malwaredomains.com - pulls from many many sources, spammers, exploit kits etc. emergingthreats.net - Known compromised hosts in snort format, Russian Business Network lists and more.

And then you get to the lists you pay to be a part of, I believe Arbor networks rolls one out and their are many other paid lists which are apparently effective though costly. If you are working for a company or in a specific industry you can find ISAC groups which share information such as lists of fresh DoS sources, botnet url's etc as long as you adhere to all rules, charter and share back. I also highly recommend reading up on ISC SIE, you can find more information here https://sie.isc.org/.

I hope some of these resources can help you in your search for lists but take it from someone who maintains a very large one daily, you should utilize other resources for DoS prevention as they are much more effective.

share|improve this answer

Is the Spamhaus XBL something like what you're looking for?

http://www.spamhaus.org/xbl/

The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of hijacked PCs infected by illegal 3rd party exploits, including open proxies (HTTP, socks, AnalogX, wingate, etc), worms/viruses with built-in spam engines, and other types of trojan-horse exploits.

It is more concerned with senders of spam email, but maybe it's some use.

share|improve this answer
1  
thanks, the XBL looks interesting albeit catered more for spam protection rather than web app protection, if I understand correctly. Will study it a bit more. –  shavian Aug 5 '11 at 10:18

I guess something should be noted on the botnet and DDoS.

The main interest of the distributed system of the botnet, is that you cannot identify a bot from a genuine client. Think of it like this:

Scenario

Someone infects many computers by sending a virus. Each tricked user is now part of the so-called botnet. Let's say you have 100M bots.

Consequences

IP address usage

This scenario implies that the IP addresses of the bots have dynamic or static IP addresses depending of their ISP policy. So collecting IP addresses is worthless. Soon or later, the pool is going to be renewed.

Distributed network and identification

DDoS works this way: you will ask each bot to connect to one server. Question: How do you know if they are trying to access your server for a legit purpose or just to saturate your connection pool?

Given this, as you can't identify whether a client is part of the attack or not, you cannot compile a reliable list of IP of the distributed network.

Conclusion

Although is it not impossible, I think that the prevention of DDoS attacks by IP is not possible because of the two exposed challenges: use of a real identifier (IP address) and identification of bots.

Maybe if a group of servers would report attacks on live to a master server, it is more than probable that the next attack from that set of bots will have different IP addresses. Furthermore, you cannot deny access to your site if an IP appeared once in the list of one address that tried to access one server know to have suffer a DDoS attack, because you will ban legitimate clients that do have nothing to do with the attack.

By the way, I never heard of such a list.


TOR network exit node are more easily identifiable. Some resource like http://proxy.org/tor.shtml

share|improve this answer
    
M'vy - I am aware of ISP DHCP churn, NATing problem, etc with any such solution. However, I have lately come across commercial as well as community feeds that monitor C&C activity of botnets and deliver feeds based on that. For example: umbradata.com/solutions dshield.org/reports.html cyveillance.com I understand they would not be foolproof.. –  shavian Aug 2 '11 at 6:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.