5

So i had a debate recently where one of my colleagues believed that by launching a penetration test (one requested by our clients) from our one of our IP's we could potentially get that IP/all IP's in our block banned.

We are signed up with an ISP that allows for this kind of activity on our link (as long as its legally done), so my question is, do ISP's have the ability to detect and blacklist attack traffic on their networks? Do end-point 'client' firewalls have the ability to blacklist IP's not just on their firewall but to 'report it back' to some central server somewhere which will blacklist our IP across the world (to anyone using that blacklist)? I know such blacklists exist for Spam sources but i'm not sure about attack traffic.

Note:

  • We are not using any bandwidth intensive attacks (like DDoS attacks which would adversely affect ISP traffic)

Hope someone can help! Thanks

Improve this question
3
  • "We are signed up with an ISP that allows for this kind of activity on our link (as long as its legally done)..." If it's allowed, why are you worried?..
    – user10211
    Feb 14, 2013 at 9:12
  • I think he's referring to the client's ISP.
    – g3k
    Feb 14, 2013 at 14:45
  • 1
    @g3k Yes. But also the wider internet.
    – NULLZ
    Feb 15, 2013 at 6:01

1 Answer 1

Reset to default
6

Detecting the attack traffic from a penetration test requires deep packet inspection. DPI is very expensive to implement on an large level and doesn't directly generate revenue.

Common uses of DPI by ISPs are:

  • Lawful intercept. This is mandated by authorities and is targeted.
  • Targeted advertising. $$$
  • Quality of service. Generates revenue by offering good QoS.
  • Offering tiered services. Also revenue generating.
  • Copyright enforcement. Mandated or paid.

One way for an ISP to enforce an acceptable use policy is to perform DPI on a statistically meaningful sample of the traffic.

Do end-point 'client' firewalls have the ability to blacklist IP's not just on their firewall but to 'report it back' to some central server somewhere which will blacklist our IP across the world (to anyone using that blacklist)?

Unified threat management products are able to centrally manage alerts and push derived rules across the network.

Improve this answer
4
  • The key thing i am after is not if i'll be blacklisted by the target client network, but if, by being blacklisted by a corporate network, i will, in turn, be blacklisted by a 'blacklist feed' for example www.spamhaus.org.
    – NULLZ
    Feb 14, 2013 at 10:23
  • Some businesses run SPAM traps and honeypots in the internal network/DMZ that automatically send malware binaries and source IP addresses to spam/malware collecting websites.
    – Cristian Dobre
    Feb 14, 2013 at 13:22
  • @Christian client run Honey pots for example, if i don't deploy any malware. Will they potentially add me to a blacklist somewhere?
    – NULLZ
    Feb 15, 2013 at 6:03
  • You could be bruteforcing an SSH login or exploiting a honeypot service and then be picked up by the trap.
    – Cristian Dobre
    Feb 15, 2013 at 9:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .