9

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar list?

  • How effective would this in thwarting DDoS or black hat/covert activities?

  • How would I implement such a solution? (I'm open to free or paid solutions here)

Edit

Assume that the users of this web site (or other network resource) should not be anonymous. This could either be by company policy, in the terms of service, etc.

This is an exercise in limiting risk for the service provider.

  • 1
    What you want to do is not possible. If it were then TOR would be useless because everyone would block it. If this a website that is designed to be only accessed from the internal network for a comapny it is possible. The simple solution to to block every address except the internal ip addresses you assign. – Ramhound Mar 19 '12 at 13:08
  • @Ramhound, we can just block all the TOR exit nodes right? – Pacerier Jul 17 '12 at 20:35
8

My first thought is that if it's a DDoS attack, the source is most likely going to be infected zombie machines that the operator could care less whether they're traceable because they won't lead back to him. I'm sure a good number of black hat users use Tor to try and cover their tracks, but I'm also willing to bet there are more legitimate users on Tor than not. So essentially you could block all Tor traffic, but in the end you might end up blocking more good guys than bad guys.

  • I updated the question... assume part of the Terms of Service or Corporate policy is that TOR must not be used. – Christopher Mar 16 '12 at 14:39
  • 1
    @Safado, why does legitimate users need to user Tor in the first place? – Pacerier Jul 17 '12 at 20:36
  • 1
    Do you honestly think that only bad guys use Tor? – Safado Jul 17 '12 at 22:48
  • 3
    @Pacerier, why do we need laws against random police officers searching random houses without any reason at all other than "You do not have anything to hide, do you?" Using Tor for legitimate purposes is good because it makes the usage of Tor less of a red flag. If Tor was only used for illegal tasks (such as reporting of human rights violation, circumventing censorship by the USA or their own countries), the risks would be even higher. – Hendrik Brummermann Aug 10 '12 at 6:27
7

I would like to encourage you to take a look at the following links:

The TOR project has an entire FAQ page concerning abuse including a section called "I want to ban the Tor network from my service." where they elaborate on how to identify and block TOR exit nodes and what alternatives there might be to doing so.

Also there are currently 400k people using TOR, the USA being #1 with around 14% (60k). This might have a bad impact on your company's image. ("They are contra-privacy!" "They are in favour of warantless wiretapping!", ...)

0

A serious attack would swamp your ISP, so your local solutions would be irrelevant. Your ISP might cut you off and/or expect you to pay outrageous excess bandwidth fees.

Even one determined attacker can cause a lot of problems for a site that runs on ordinary hardware, so preparing defenses based on blocking particular IP addresses is still worthwhile.

You should also note that what you perceive as an attack is more likely just a misconfigured web crawler or other relatively innocent program misbehavior. That's good, because simple blocking is likely to be effective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.