w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?

Question

It's only an idea. I've recently logged that my server is scanned by w00tw00t tools.

I found many solutions to this, such as use of apache mod-security, fail2ban, etc..

The one I want to speak about, is usage of iptables to block such IP's, based on apache log matching.

If I would use any presented idea, about how to block those scanning address, we must point out important fact, which is requesting IP's are almost every time spoofed, which means, they don't belong to attacker.

Isn't this idea then causing damage to our common users? If I would block out IP, which was spoofed by attacker, I would block someone, who is not causing me a real damage, which means, in conclusion, none of the iptables based defense is usable, or am I wrong?

Or worse, could this server-side preventive measure be used as attack? Such as If I need prevent somebody from accessing site, I will spoof his IP and get it blocked by this preventive system using iptables blocking, isn't it?

Study material:
http://blog.urlvoid.com/w00tw00t-at-isc-sans-dfind-web-scanner/
https://serverfault.com/questions/125607/dealing-with-http-w00tw00t-attacks
http://profi-admin.com/Articles/Showfull/06/05/2010/Administration/How-i-got-rid-of-the-w00tw00t-entries-in-my-server-logs
http://foxpa.ws/2010/07/14/using-dfind-exe-and-blocking-w00tw00t-at-isc-sans-dfind/
http://www.myatus.com/2010/07/17/blocking-w00tw00t-scans/
http://spamcleaner.org/en/misc/w00tw00t.html

Answer 1

TCP connections are not easily spoofed. The reason for this is the three-way-handshake that must be completed before the connection is considered "established". The connection must be established before an HTTP request can be sent.

UDP packets are easily spoofed but can't be used to attack Apache.

Since HTTP works over TCP connections, you can be confident that the IP address you are blocking is actually attacking you at that time.

An IP address that is attacking you today might be owned by a legitimate user tomorrow or even potentially at the same time if your legitimate user is infected and is part of a bot net. It's worth making sure your firewall rules expire some time after the last attack was seen.

If you are particularly worried about false positives, you can create a custom 403 page that includes an out-of-band method of contacting you ( such as an email address or a phone number ) and then block the IP addresses using Deny from 1.2.3.4 in your Apache config.