3

For the past days some script kiddie has been scanning our site with w3af and some basic manual checks. Although I know the site is "secure" because I analyze it almost everyday, I'm not perfect and some hole may be found.

I told my coordinator to block that IP, as he (the kid) is always attacking from the same IP, but my coordinator said that we can't do that because we don't know whether it's a static or dynamic IP, and he didn't want to prevent some legitimate user to access the site.

So what other alternative do we have to prevent the script kiddie to keep trying to find something? A WAF is not possible.

Improve this question
5
  • What constraints are preventing you from using a WAF? How much effort are you willing to expend trying to stop someone who poses a negligible threat?
    – thexacre
    Commented Sep 10, 2014 at 11:40
  • the problem of the WAF is that it's impossible to test it with real traffic without screwing everything up. In fact, ModSecurity is installed but disabled, because since the very moment I enable it (even just logging), the server gets overloaded.
    – user15194
    Commented Sep 10, 2014 at 11:58
  • 3
    Block the IP for a couple of weeks? The attacker will possibly loose interest and move on to the next site.
    – KDEx
    Commented Sep 10, 2014 at 14:53
  • @KDEx do you really think so? Getting IP blocked would delay him for all of 5 minutes until he gets a new IP; either you're able to have such things blocked automatically or it's not worth the bother - you'll cause yourself more work than the attacker.
    – Peteris
    Commented Sep 10, 2014 at 16:23
  • @Peteris Its about increasing the level of effort. If this is a "script kiddie" does he really feel like hopping on tor or using a vpn? Maybe maybe not. Blocking an ip is not necessarily difficult. If he continues you've at least profiled the threat and have more information now than you did before.
    – KDEx
    Commented Sep 10, 2014 at 16:25

2 Answers 2

Reset to default
4

If there is no discriminating feature of the traffic that you can analyse for and block, and a WAF is not possible then blocking the IP is your only real option. Your coordinator is correct in that blocking the IP could result in you locking out authentic traffic, so the question is whether the potential for loss from the hacking attempts is greater than the potential for loss from blocking the IP.

Put together some statistics of authentic and malicious connections from that IP. If you have lots of authentic compared to malicious then it's not worth blocking it as you're going to alienate your customer base, however if it's mostly or all malicious you have nothing to lose from blocking the IP and the case is strong.

Improve this answer
1
  • I agree that there is a basic risk vs reward calculation here. If the attacker finds a hole, then the site is down for everyone. Block the IP for a week. The potential limitation of a few users behind a shared IP has to be weighed against the impact of an outage of the service.
    – schroeder ♦
    Commented Sep 10, 2014 at 15:34
2

I would focus less on preventing this one person from analyzing your site and more on doing as much as you can to be sure your site is secure. Even if you do block this one person, someone (or something) else will come along eventually.

It sounds like you have taken steps to make the site more secure (which is awesome!), but make sure you are taking the appropriate steps to ensure your security audit is complete as possible. I like the "Web Application Hackers Methodology" chapter of the Web Application Hackers Handbook for this. It will give you detailed instructions on how to perform a thorough security audit.

Once you have done that you might consider using something like BugCrowd to see if you missed anything. You could also hire a professional security auditor to look at your site, but this can be very expensive.

Improve this answer

You must log in to answer this question.