1

A good number of websites these days are not served directly over the internet, but through an intermediate providers, such as Cloudflare and Incapsula.

A basic premise of the security provided by these services involves not revealing the original IP of the server. Websites often leak their IP through MX records or through "direct" DNS records.

We'll now assume a website which does not leak its IP through such common techniques. The website, however, has some form of an URL traversal functionality controlled by the user, such as:

  • A website screenshot service
  • Generation of "link cards" on social networking websites
  • "Redirect checker" websites

Now, all the attacker needs to do is to type in an URL pointing to his own server and observe the server's request log. In the case of the "screenshot" services, it is even more trivial to do so: the attacker simply needs to point it to one of the "What is my IP" websites, and voilà: they have your IP.

What set of mitigations can be used to handle this IP leakage effectively?

Improve this question
1
  • 1
    Since the web server works in these situations as a web client (i.e. like a browser) it can do the same things as other users wanting to hide their IP can do: use a VPN, proxy or similar solutions to access external sites.
    – Steffen Ullrich
    Commented May 11, 2017 at 19:59

1 Answer 1

Reset to default
1

It generally all comes down to the question: how important this functionality is for your business?

Option A: said URL traversal functionality isn't very important for the Web site. Say, that site can do a lot of things, and taking screenshot is a feature the site can more or less still live without.

Then it's enough to use any VPN or proxy on a different IP address (or, better, in a completely different IP network or even ISP/hosting provider) to connect to untrusted sites. Make sure the proxy doesn't set X-Forwarded-For, Forwarded or X-Real-IP HTTP headers (some of them do it by default). Also make sure all service traffic like DNS queries is routed through the same proxy or VPN.

Option B: the URL traversal is a part of the core business critical functionality, the Web site won't run without it.

Then a DDoS mitigation of some sort should be applied there too.

  • Good news: compared to the complexity of a typical Layer 7 DDoS protection nowadays, protecting such a functionality is rather simple: a provider only needs a decent amount of bandwidth and a stateful firewall with a TCP connection tracking ability near the network border.
  • Bad news: as of early 2018, neither Cloudflare nor Incapsula can do that, so you need to choose another provider for that. If you happen to have your own IP prefix and an autonomous system number, probably a BGP-based DDoS protection suits you even better than DNS-based one in this case, especially as we currently are running out of IPv4 address space.
Improve this answer

You must log in to answer this question.