I work at a network consulting company, got a bunch of letters after my name, wrote a book and been doing this a while, so a little bit familiar with IP networks.
What is geo-IP blocking? Just like it sounds, it's taking big chunks of IPs and blocking them from your network indiscriminately, for no reason other than where they come from, geographically, on your firewall or it works on routers too.
Just some statistics for you. This is a study done by Spamhaus of the top spamming countries and I'm not giving you the whole list here, but these are the top three.
No surprise, USA is number one. We love to be number one at everything, this is no exception.
But right behind us is South Korea, China, Taiwan right behind that, so there's a number of countries that this is concentrated in, adds up to about 21% for just those two.
This is just spam, but it's an example of where that stuff's coming from.
Why do this? First reason is it's easy, it's quick. You don't have to buy any new hardware or software, you can just put some entries in your router.
Again, no cost, just typing it in. You might have to spend some labor to type in some of the larger blocks, but it's still not a whole lot of investment.
You also enable you to sort of blanket avoid all kinds of attacks, not just spam or viruses or worms, we just drop everything, period, forget it.
We're just not going to accept anything from those areas. It's easily reversible, so if you don't like it or it's not working, it's causing problems on your network, take it out and you're back to where you started.
So you don't have to un-configure the software or take pieces of hardware off your network.
Users can still get to the websites in those countries. We're blocking inbound connections, we're not necessarily blocking outbound. You can block outbound, that gives some additional benefits, but also some additional potential problems.
So the option is there for you. Most companies, let's face it, don't need to have these countries accessing their network.
Fortune 500 companies, that's not necessarily the case, but there's a lot of other companies out there that don't necessarily want or need to do business with these countries and there's no reason to accept inbound connections from these locations.
And again, even Fortune 500 can use this on a limited basis for certain types of servers, things that, internal intranets, things like that, that aren't, they're not going to be people connecting inbound, you can still open up your website, email server and so forth. So it's not just for small companies, medium-sized companies.
More reasons. Over time, more and more stuff will probably move offshore from the U.S. The U.S. is still just a big part of the internet and still generates most of the traffic, but as time goes on, we'll probably see that the problem or the solution would ever get worse or better.
It also has the effect, similar to spamming blacklists, of forcing bad actor countries, as I call them, to take some actions. And this, in fact, has happened with China and spam. They've recently introduced some laws and arrested some people and God knows what in their usual way, but still they're taking action and starting to become more of a good net citizen because of this pressure.
What can this help with? Well, as I was saying before, it's sort of a blanket approach so it can block spam, of course, was our example. Email fraud coming out of those locales, phishing attempts, viruses, worms, automated hacking tools, manual hacking, mostly script kitties. I know you can spoof the addresses and do all kinds of fun stuff like that.
If someone's really concerned about getting to your servers, they can manage to do so, even with this. But, as we know, 90% of the stuff out there or more is kind of dumb and doesn't do that. And also, I say, prohibited off-site content, porn, gambling, if you block the outbound connections from your network.
Why not? Well, one does not make sense. It's not 100% effective, what is. But if you're looking for a silver bullet, whatever, this is not it. This is just yet another tool, another layer to help with your security protections. Some people may have a problem with it in that it goes against the idea of global access to everything all the time.
And again, if you're a big company, you probably can't do this on your public servers or web, your email. Or if you're even a small company, say, doing business in Japan or overseas areas, however, you can still block, say, China, if you're doing business in Europe or elsewhere, you can still take the effort to block the bad guys.
And again, it's going to block emails and things like that as well. So, if you're expecting to get legitimate business email, you don't want to block it or you want to take a more limited approach. Example, my company, we primarily deal with community banks in Texas. There's very, very, very low possibility of anyone trying to do legitimate business with any of those countries with me.
Frankly, if I had one customer who wanted to do business over there, I don't want them. So, in my case, it makes a lot of sense.
How it works. Let's start at the very top level. Some of y'all may already know this, but IANA assigns out big address blocks to what's called the regional internet registries, or RIRs, that handle more regions, continents, what have you, and they handle assigning things regionally.
ARIN is the RIR that handles North America. Has anyone ever had to file for IP space with Dennis Swift? Yeah, a lot of fun, right? So, you know all about ARIN and how they work.
Other RIRs that we'll talk about primarily, because ARIN is not part of this talk, we don't want to block ARIN, otherwise we'd be blocking ourselves and most of the other stuff that we want to get to.
But some of the other RIRs that may be of interest, APNIC, which is Asia, Asia Pacific Network Information Center, RIPE, which is Europe and part of the Middle East and Central Asia, LACNIC, Latin America, and AFRINIC, which is a new RIR that just got assigned for Africa.
Talk about some of the RIRs specifically and which ones make less or more sense to block. APNIC, Asia, as I said, now this takes in several of my top bad actor countries, number 2 and number 3 spammers, for example.
Just by blocking APNIC, and this is an example that I've proved to myself, you can end up blocking about 20 to 30% of your malware headed for your public servers just from APNIC, because so much stuff comes out of that region.
However, be careful, if you do a blanket lock, Japan, a lot of business gets done over there and some other areas, so you may not want to take a blanket approach.
I do, and it hasn't hurt me yet, but you've got to make that determination.
Here's the IPs if you want to take a blanket approach. The good news is it's just not a whole lot of statements really, it's some big pieces of network, big slash 8s, and put a statement in your router firewall and drop everything.
I have to add here, Cabot Enter, this list, not necessarily complete, you want to check with IANA and make sure that this is the latest list, and you don't need to jot this down, I don't see anyone writing down anything anyways, it's too late in the day, but it's on the CD and on the website, so you can get all the numbers off of there.
Here is an example if you say you don't want to take that blanket approach, you just want to block China, you also have to take into account that many organizations, suborganizations, within a region may not necessarily have IP space that's assigned to their RIR, they may get it from Aron, they may have applied, they may have an American parent company, or they may have applied a while back, or just, they may have wanted to get that space for another reason.
So, if you really want to be 100% accurate, you've got to go out there and find out all the IP addresses associated with that, including the Aron space.
Here's an example of the China only IP blocking, if you want to do that.
Don't worry, again, don't write all this down, it's on the CD, it's on the website, and I'm going to show you at the end a way to get this front list automatically, so, instead of having to take it all off this presentation.
Here's Korea, same kind of thing.
Europe, Europe's a little bit more of a mixed bag, because you've got a lot of small countries there, there's a lot of governments, there's a lot of multinationals, it's really mixed up over there, and it's pretty hard to block the whole thing, I don't recommend it.
But you can sort of take a couple of countries that are particularly troublesome, such as Russia, and drop that, because a lot of stuff comes out of Russia, and again, a lot of companies aren't necessarily doing business with Russia, needing to provide access to their network to there.
But, if you do want to take it out, there it is, that's the RIPE address space, again, not a whole lot of statements in your router config, type them in and go.
I'll be giving examples at the end.
LACNIC is Latin America and Caribbean.
A lot of these organizations use air and space, again, because they either have a company in the U.S. or they want to, they've established their presence there.
But if you want to take a rifle approach, Brazil and Argentina are the bad, the worst guys, I should say, over there, and you can take those out.
If you're a border company, border state, or you're doing a lot of NAFTA business, you may just want to skip this. I don't block it myself, so it's up to you on how permissive or not you want to be.
Pretty small set of blocks for them at any rate, so pretty easy to block, blanket.
Here's the, these are just examples, again, I'm going to give you guys a tool to get the custom list for your network, but there's the list for Brazil.
AFRINIC, this is a new brewer, and just a lot of bad stuff comes out of here. Not a lot of legitimate commerce being done, unless you're an energy company or maybe a tobacco company.
There's just more or less a lot of offers to transfer $20 million into your bank account for a Nigerian general or something, so you may want to just go ahead and block that.
It's one slash eight, and probably not going to cause you any problems with legitimate commerce.
A couple of strategies you can take towards this, as I mentioned, shotgun approach, just block them all. Just take them all out, and if there's problems, then you can always go back again.
Myself and a lot of companies that I've talked to, they've done it, and it just didn't seem to bother them at all.
So you can block the entire rare space and be done with it. It's easy and quick, but you might end up blocking some countries that you do want to do business with.
Example, Australia, New Zealand does use some of that space. Some sites do, some sites don't, so you need to be careful.
The rifle approach, which is generally what I recommend, is taking country-by-country assignments and saying, I want to take these guys out.
Easiest thing to do, if you want a quick hit, is those top three, China, Taiwan, and South Korea, and get a 20 or 30 percent, lessen the load on your DMZ servers, your mail servers, by 20 to 30 percent, without doing a whole lot of harm to anyone wanting to come in legitimately.
It is time-consuming. You do have to kind of keep up with the configs, but there are some ways to automate that, which I'll show you in a moment, to speed up that process.
You can also take a little more of a limited approach on a protocol level and say, well, I'm only going to block, I'm going to block everything but mail, or everything but mail and web, so the mail servers still function and the web servers still function, but if someone's trying to SSH or telnet, FTP, that stuff gets dropped.
You can also block different segments, so you're going to block anything headed for your private land, but let's leave the DMZ wide open, but you don't really get any spam benefit here, or public server exploit benefit, you get, you know, zombie stuff and things coming into your network, your land, but you're not going to get the server benefit if you do that.
You can decide to go the other way and allow everything, but we're only going to block interactive services, telnet, SSH, things like this, terminal services where someone could get in and possibly do some damage.
You can pick certain servers to block, so you have a VPN server or database server, and you're just going to block it for that specific host or set of hosts, not all your other servers.
We might decide to block the entire RIR, but leave open a certain hotel or ISP web space, sorry, web space, that should be IP space, to allow VPN access if your company has a deal with Hilton and everyone stays at Hilton, you can find out their IPs and not block that.
Some examples, and this is not rocket science, you're all probably familiar with IP chains, just a simple deny statement. You do have to enter one of these for every block, every contiguous block, so you can't, at least in IP chains and IP tables, there's no easy way to block them all with one quick statement.
This is the IP tables example, ignore that it says IP chain, sorry, I edited this this morning and was not expecting to have to go until Sunday, so there may be some typos, but there's the IP tables example.
Cisco, if you're into Cisco, there's the Cisco example.
SonicWall, and so on, just whatever particular router or firewall that you happen to like, figure out the syntax and the numbers.
Here's an example on IP tables, I was talking about letting web through, so we're using the not operator to deny everything except it's not web, we're going to deny it if it's not web, if it's web, it comes through.
And you can add D ports and add additional ports if you want to, web, mail, whatever.
Automation, what makes all this make sense?
Well, there's a site out there, excellent site, ip.ludos.net, and there's actually a couple of sites, I happen to find this one to be the easiest to use and it's free, and they're not trying to sell you any products.
It has a script that will generate country-specific lists and you can import that straight in using the script I'll give you in a minute.
You just pull a text file, or you can pull their whole file and parse it yourself if you want to do that, if you want to get fancy with your own script.
And there's also commercial companies that will actually generate your configs or your files for you for a fee, if you want to do that.
I think one of them is called country, ip2country.com, it's not on there, but that's an example of one of those.
Starting to see some, especially in Europe, some ISPs are doing this, large website search engines, we're starting to see some of the bigger companies actually use this technique.
Kind of interesting on their part that they would do that, but they're obviously, they see the value in avoiding all that bad stuff.
Here's a quickie script, again, forgive me any syntax errors since I jammed this out this morning, but this basically will grab your text file you pulled off Ludost site and drop it into IP tables.
Go line by line and create the entry, so all you have to do is grab the file and run the script, you can automate that in cron and, you know, it'll get all your IPs updated.
That Ludost site updates daily, so they have pretty current information on them.
Resources, this is a good list, a blocking list, this also includes not country specific, but other things like big spammers and so forth, so if you don't want to just do geo, you can also block by types of bad things like spam and so forth.
And that's the Ludost IP to country database.
Got a little extra for you guys, since you're having to watch this presentation, so the one you're expecting.
We were going to originally, we proposed to do a full session on hacker related humor, they did not elect to let us do it, but you guys are going to get it anyway, so I have some extra time.
A shortened version.
I've got a top ten list for you.
This is the top ten pickup lines overheard at DEF CON 13 in the home office.
Number ten.
Want to go war driving out by the point?
Hi, I'm with tech support, can I have your password?
That didn't go over very well.
I'm serious, I really need your password.
Got the password, but no date.
Hosting a private version of the TCP IP drinking game later in my room.
Just you and me.
Hey, snarf this.
Number five.
Hey, mind if I try to pick the lock on your bra?
Try to spot my little federal buddy.
Hey, I heard there was a really cool PGP signing over at Caesars.
Want to go?
Number two, this is for the ladies in the crowd.
Figured to give this to you.
It's kind of complicated though.
You really have to master it.
It's difficult.
Hi.
Works.
Finally, number one pickup line overheard at DEF CON 13.
Hey, did you know I'm a speaker at DEF CON 13?
That's it.
If you have any questions on this or anything else,
my email is thallett at netsecuritiesservices.com
and the presentation will be posted to my site as well as it's on the DEF CON site.
And feel free to email me abuse, comments, questions.
Any questions right now?
Since we're done pretty early.
Yes.
You said there's...
The question was he was blocking Korea and he found legitimate hotmail traffic coming from Korea.
Yeah, I've not heard of that.
I mean...
Yeah, I've not seen that at all.
Some people might say that blocking hotmail is...
A lot of companies block hotmail anyways.
But I block it and I have hotmail and never had a problem.
But it's interesting.
I'll have to check that out.
Yes.
Like a...
Kind of like a honey net, sort of, kind of.
And how do you determine if it's invalid SMTP connections?
From those by IP?
Or...
Okay.
So you sort of built a white list of IPs, huh?
It's interesting.
Yeah, I mean, you can do all kinds of interesting things with your IP table statements about what you do with it and where you send.
I mean, drop, deny.
And you can get really fancy with it and do fun stuff with it.
In the simplest form, you just drop it.
But...
And again, the scripts can get a lot fancier in terms of the importing.
You could actually go out to the website.
We could build a PHP script to type in what countries you want to block.
You know.
We haven't done that because we don't need it.
But someone out there could probably whip it up pretty quickly, I'm sure.
You blocked all email addresses except for...
Huh.
Yeah.
Yeah.
I mean, that would work.
You don't get any complaints about that?
Good.
Good for you.
Question back here somewhere?
Good question.
I don't know.
Since it's not really a reality yet, I haven't dealt with that.
And again, I don't try to oversell this.
This may only work for a year or two.
But to me, if it takes me 15 minutes and it works and it does something, it's worth doing.
But yeah, I mean, IPv6 could throw a wrench in that.
Because I don't think they're going to be assigning things regionally anymore with that.
Also, I didn't mention this, but some other fun things you can do with...
You can do geo-IP detection.
And write some snort rules to detect Chinese IP addresses on your network for some reason.
So we've done that too.
Well, if it did get through, it's on our network now, let's throw up an alert.
So there's some other advanced topics.
But again, this is just something down and dirty that you can do that might save you some grief.
And anything that lowers the percentage chance of me getting exploited.
And that cost is low and the benefit is relatively high, is a good thing to me.
Any other questions?
Great.
Thanks for coming. I really appreciate it.
And have a good show.