How does one decide whether to block malicious scanning activities?

Question

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the zombie computers would be reprogrammed to look for the new flaw. If a server is not updated immediately when an exploit for a particular software that the server is running is discovered, then it will be susceptible to an attack.

Monitoring and tracking malicious activities and actively blocking them takes time and effort and may consume more resources than just issuing a 403 or a 404 error. How does one decide if a certain scanning pattern is cause for concern to warrant taking pre-emptive measures such as totally blocking them?

Answer 1

Ideally you would like to manually inspect any abnormal occurrence. Since there are only 24 hours per day, this necessarily implies some heavy pruning, in which you automatically filter out the bulk of the automated scans. For instance, I see in my logs many attempts at accessing phpMyAdmin. I don't have this tool on my server, therefore I can safely ignore all attempts at exploiting its flaws. With similar rules for some other common attacks, I can lower the level of noise in my logs sufficiently so that I can afford to manually check the remainder.

Any attack attempt is cause of concern until you have fully understood and analysed the attack, and concluded that "it cannot work" (e.g. my case with phpMyAdmin), at which point you can ignore it. On the bright side, experience shows that between the discovery of a vulnerability, and its wide scale industrialization by bot nets, there usually is a delay of a few weeks, so patches will come first if you maintain your server properly.

Answer 2

Number of scans is important and so is the ports that are being scanned (if you get a continuous scan of a range of your ports from somewhere there is probably something fishy going on). Also you can always check the vulnerabilities of the services that your computer is using/running by checking the security changelogs of the software that you have installed and analyse them in order to see what can possibly go wrong. When it comes to exploiting the installed software on a target-machine once a hacker finds out which ports are opened there and what's running on it (using various port scanners incl. stealth port scanners that don't establish an actual connection!), he/she starts digging online with the purpose of finding vulnerabilities (there are also various "dark" sites that handle such precious information and where black hat hackers can brag about new exploits they have found). That's why it's always a good thing to not only have the latest version of a software but also keep it on the latest patch-level.