43

I am located in Venezuela right now, and for the whole weekend have been unable to access grubhub.com and seamless.com.

Finally, I tried using the Tor Browser and got access. The same thing happened in January when I tried to access the police department's website in a New York State county when I was abroad.

Is this a measure to avoid hackers? Or do they do it to avoid spending bandwidth in countries where the website doesn't serve the population?

  • 5
    Your question might need to be reworded. It's difficult to answer why those particular sites have done this. – schroeder Nov 3 '14 at 16:11
  • 6
    Your examples and the remainder of the question might not be related at all. Have you e.g. tried checking your IP address with various CBLs / DNSBLs if it's perchance blacklisted? Some countries' ISPs tend to cycle between DHCP assigned IP addresses rather fast (India is one known example), and at that time you might have been assigned an IP that was blacklisted. Either case, a single IP being blacklisted in public CBLs that some websites (like your example ones) might use isn't indicative of a country-based blocking. Use e.g. ipvoid.com to check through many public CBLs / DNSBLs. – TildalWave Nov 3 '14 at 18:40
  • As long as they're not smart enough to use VPN and proxies. Often as effective as the Maginot Line was at keeping the Germans out of France in WWII. There's always a way around. – Fiasco Labs Nov 3 '14 at 23:33
  • Only bad hackers. – Peter A. Schneider Nov 4 '14 at 5:16
  • 3
    Note that when blocking a whole country, only legitemate users will be blocked, because your "hackers" never use their own IP address, but work through either others, or via proxy's/VPN's, which could be based anywhere but their own country – Lighty Nov 4 '14 at 8:14
74

Country-based blocking is usually put in place as a result of some organisational policy whose intention is indeed to "block hackers". This sort of things fail on three points:

  1. Such a policy assumes that malicious people can be categorized by nationality. This is old-style, World-War-I type of thinking.

  2. Geographical position is immaterial for computers; a firewall can only see IP addresses. Inferring geography from IP addresses relies on big tables that are never completely up-to-date.

  3. As you observed, working around these blocking systems is trivial for attackers; it suffices to use a relay host outside of the blocked country, and this happens "naturally" when using Tor. Most attackers will use such relays anyway, to cover their tracks.

So the usual net effect of such a blocking is to irritate a few normal users (who might have been customers, but will not now that they are angry), without actually impeding the efforts of competent attackers.


On the bright side, though, "country"-based blocking is sometimes put in place to prevent thousands of mindless drones from spamming the connection logs. For instance, the sysadmin might have noticed a surge of dummy connections from some botnet, most machines of which being located in Venezuela. In that case, blocking Venezuela altogether may help prevent the clogging of log files, while implying only minor impact on business (assuming that the server in question has very few honest Venezuela-based customers). Thus, it is conceivable that a risk/cost analysis has determined that such a large blocking would improve things.

However, in most cases, the "country blocking" is there for the show: a whole-country blocking helps sysadmins demonstrate to managers that they are doing something for security, in a way that managers readily understand. This is the usual predicament of security: when all things work well, security is invisible. It is unfortunately hard to negotiate budgets for activities that don't imply any visible result. Even though the whole point of security is to avoid having visible results, e.g. a defaced Web site or a list of 16 millions of user passwords leaked and hitting the news.

In the case of media distribution, some distributors enforce country-based blocking because they did not have whole-World retransmission rights, and by doing a modicus of blocking effort they fulfil their legal obligations. Arguably, this case is also "for the show".

  • 14
    The intention may not necessarily be security, so much as noise reduction. If you never get any legitimate traffic from a location, and your logs are filling up with errors caused by bots, blocking the whole country just makes an annoying problem go away. – barbecue Nov 3 '14 at 17:33
  • 16
    Country-based blocking is the Maginot Line of policies, because I can just proxy though neutral Belgium. – user57007 Nov 3 '14 at 18:13
  • 3
    +1. Since "blocked" in the question is vague, country-specific blocking is used to licensing issues as well. TV sites in the US, for example, block access to the videos (not the entire site) based on the viewer country. It's not necessarily to block bots or anything - it's just the legal issues with licensing. – Ayesh K Nov 3 '14 at 18:17
  • 3
    I think the ease of bypassing this filter is a boon to the strategy, not a pitfall. It allows persistent legitimate users to continue using the site. This is like running a service on a non-default port. It won't stop any real person at a keyboard with an attention span of more than 10 seconds, but it will cut down on 99% of automated breakin attempts. – Wug Nov 3 '14 at 20:25
  • 6
    Why does everyone assume it's to "block hackers"? Given the example of GrubHub.com, a US-based site that offers online ordering for US-based restaurants, what legitimate use would a person from VZ have to visit the site? Chances are, the sales loss of the 0.5% of actual legitimate users that get blocked is offset by the resource savings of not having to serve the whole site to a country where the site is generally not useful (and thus from which most traffic is likely spammers/hackers/etc). – Doktor J Nov 3 '14 at 23:08
26

In my case, our expected customers come from predictable countries, and so to limit the "threat surface", other countries are blocked.

This has limited value as any determined person can do what you did and simply re-route their traffic. The side benefit, though, is that the countries we permit are those with stringent cyber-laws and we can get law enforcement help if an attack happens. So, if an attacker from an non-allowed country routes their traffic through an allowed country, we can get the police involved. It's a small thing, but it does lower the risk without any impact to business and at no cost (except for the time to enter the allowed country into the firewall's whitelist).

When I did this, the bad traffic load on our web servers dropped 90%, which is significant in terms of resource cost-savings, if nothing else.

  • 6
    Exactly this. It's not perfect, but if your target audience is highly country-specific, then why leave the front door wide open for attackers from other countries? Sure some will find windows, garage doors, and the like, but 95+% will just move on to other targets. – Doktor J Nov 3 '14 at 23:12
  • How would "stringent cyber-laws" help if the actual attacker is far away from that country? – JonathanReez Nov 4 '14 at 15:12
  • The attacker, then, is not the issue, but the pivot point is. – schroeder Nov 4 '14 at 15:30
  • @schroeder I still don't follow how would the police help you out after the fact – JonathanReez Nov 4 '14 at 17:21
  • 1
    If there is an active attack, it is easier to have the attack traced and dealt with by the ISP, because the ISP has some legal responsibilities. After the fact, it is possible to have that pivot point remedied. There are some countries where ISPs simply don't respond to my calls for help, and I know their police force do not follow up on attacks. American, Canadian, and UK ISPs and police forces do respond and can escalate. – schroeder Nov 4 '14 at 18:11
3

It's true, if a hacker would like to get access to your page, it will not help, he can simply use a vpn or proxy.

But if you think about all the bots out there which attack every page they find to test exploits and/or passwords, you will be able to block a lot of them. This will also help you against ddos attacks, if you block every country except the one you live in, you are able to block the most of the traffic. OF course, there are more effective methods against ddos attacks but a filter is a reasonable and simple one.

  • 2
    This is actually a decent point. You should expand upon it. – asteri Nov 4 '14 at 19:43
1

Some websites block countries for business reasons. Traffic from some countries doesn't generate enough revenue to warrant the resources to serve them. Sometimes companies don't want to expand into a country until they can "do it right."

It's likely not a security issue. This can be circumventing by using TOR and VPNs. Of course, they can also block traffic from TOR and VPNs, or at least monitor more closely.

This is a business or political decision, not technical.

0

Blocking per IP or IP range is pretty easy to bypass. A hacker could simply hire a server in another territory with an different IP range and then attempt to hack you from that...

  • I'm not sure how this adds to the other answers to this question. Do you have another perspective on these facts? – schroeder Nov 6 '14 at 16:43
0

In the case of a site like Grubhub, the reason for blocking certain countries is likely not hacking (technical interference) but rather an effort to thwart fake reviews and similar unwanted content. It is relatively common nowadays that people in poor countries are hired for posting spam, or spam-like things like fake reviews for a few pennies a pop.

Sure anyone could bypass this block, but that could then be detected in a different way, as these users would then likely connect through a proxy server that can be detected through a proxy blacklist. The point here is to set up roadblocks, rather than absolute security. Unlike a security vulnerability, fake reviews on a restaurant rating are not an immediately fatal threat to the site.

If this is done in a judicious way and targeting an actual problem that has been identified, it can absolutely an effective of stopping unwanted posts. To name an example, for a site I run, I found that I was consistently getting spam from Bangladesh, Pakistan and Cameroon (of all places) and zero useful traffic from those same places. I blocked, to the best of my ability, those countries from posting content, but not from reading the site. Users from these countries are now greeted with a polite message asking them to contact an e-mail address that was set up just for this purpose, if they were legitimate users. This has been effective in blocking this particular class of spam, and is an example of what I would call a well-informed and judicious use of blocking a certain country.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.