start	end	text
96350	108030	I work at a network consulting company, got a bunch of letters after my name, wrote a book and been doing this a while, so a little bit familiar with IP networks.
109270	124410	What is geo-IP blocking? Just like it sounds, it's taking big chunks of IPs and blocking them from your network indiscriminately, for no reason other than where they come from, geographically, on your firewall or it works on routers too.
127150	137230	Just some statistics for you. This is a study done by Spamhaus of the top spamming countries and I'm not giving you the whole list here, but these are the top three.
137370	142950	No surprise, USA is number one. We love to be number one at everything, this is no exception.
143730	158810	But right behind us is South Korea, China, Taiwan right behind that, so there's a number of countries that this is concentrated in, adds up to about 21% for just those two.
158810	163170	This is just spam, but it's an example of where that stuff's coming from.
163170	173630	Why do this? First reason is it's easy, it's quick. You don't have to buy any new hardware or software, you can just put some entries in your router.
174310	182670	Again, no cost, just typing it in. You might have to spend some labor to type in some of the larger blocks, but it's still not a whole lot of investment.
182670	196690	You also enable you to sort of blanket avoid all kinds of attacks, not just spam or viruses or worms, we just drop everything, period, forget it.
196830	206370	We're just not going to accept anything from those areas. It's easily reversible, so if you don't like it or it's not working, it's causing problems on your network, take it out and you're back to where you started.
206370	211610	So you don't have to un-configure the software or take pieces of hardware off your network.
212410	226210	Users can still get to the websites in those countries. We're blocking inbound connections, we're not necessarily blocking outbound. You can block outbound, that gives some additional benefits, but also some additional potential problems.
226210	236450	So the option is there for you. Most companies, let's face it, don't need to have these countries accessing their network.
236450	251910	Fortune 500 companies, that's not necessarily the case, but there's a lot of other companies out there that don't necessarily want or need to do business with these countries and there's no reason to accept inbound connections from these locations.
252390	270710	And again, even Fortune 500 can use this on a limited basis for certain types of servers, things that, internal intranets, things like that, that aren't, they're not going to be people connecting inbound, you can still open up your website, email server and so forth. So it's not just for small companies, medium-sized companies.
271450	289950	More reasons. Over time, more and more stuff will probably move offshore from the U.S. The U.S. is still just a big part of the internet and still generates most of the traffic, but as time goes on, we'll probably see that the problem or the solution would ever get worse or better.
290910	317410	It also has the effect, similar to spamming blacklists, of forcing bad actor countries, as I call them, to take some actions. And this, in fact, has happened with China and spam. They've recently introduced some laws and arrested some people and God knows what in their usual way, but still they're taking action and starting to become more of a good net citizen because of this pressure.
320290	340850	What can this help with? Well, as I was saying before, it's sort of a blanket approach so it can block spam, of course, was our example. Email fraud coming out of those locales, phishing attempts, viruses, worms, automated hacking tools, manual hacking, mostly script kitties. I know you can spoof the addresses and do all kinds of fun stuff like that.
340850	360090	If someone's really concerned about getting to your servers, they can manage to do so, even with this. But, as we know, 90% of the stuff out there or more is kind of dumb and doesn't do that. And also, I say, prohibited off-site content, porn, gambling, if you block the outbound connections from your network.
364060	386040	Why not? Well, one does not make sense. It's not 100% effective, what is. But if you're looking for a silver bullet, whatever, this is not it. This is just yet another tool, another layer to help with your security protections. Some people may have a problem with it in that it goes against the idea of global access to everything all the time.
387100	406980	And again, if you're a big company, you probably can't do this on your public servers or web, your email. Or if you're even a small company, say, doing business in Japan or overseas areas, however, you can still block, say, China, if you're doing business in Europe or elsewhere, you can still take the effort to block the bad guys.
407860	433740	And again, it's going to block emails and things like that as well. So, if you're expecting to get legitimate business email, you don't want to block it or you want to take a more limited approach. Example, my company, we primarily deal with community banks in Texas. There's very, very, very low possibility of anyone trying to do legitimate business with any of those countries with me.
433740	441060	Frankly, if I had one customer who wanted to do business over there, I don't want them. So, in my case, it makes a lot of sense.
443800	462440	How it works. Let's start at the very top level. Some of y'all may already know this, but IANA assigns out big address blocks to what's called the regional internet registries, or RIRs, that handle more regions, continents, what have you, and they handle assigning things regionally.
463380	476060	ARIN is the RIR that handles North America. Has anyone ever had to file for IP space with Dennis Swift? Yeah, a lot of fun, right? So, you know all about ARIN and how they work.
478940	488660	Other RIRs that we'll talk about primarily, because ARIN is not part of this talk, we don't want to block ARIN, otherwise we'd be blocking ourselves and most of the other stuff that we want to get to.
488660	507900	But some of the other RIRs that may be of interest, APNIC, which is Asia, Asia Pacific Network Information Center, RIPE, which is Europe and part of the Middle East and Central Asia, LACNIC, Latin America, and AFRINIC, which is a new RIR that just got assigned for Africa.
509660	527480	Talk about some of the RIRs specifically and which ones make less or more sense to block. APNIC, Asia, as I said, now this takes in several of my top bad actor countries, number 2 and number 3 spammers, for example.
527480	540480	Just by blocking APNIC, and this is an example that I've proved to myself, you can end up blocking about 20 to 30% of your malware headed for your public servers just from APNIC, because so much stuff comes out of that region.
542460	552960	However, be careful, if you do a blanket lock, Japan, a lot of business gets done over there and some other areas, so you may not want to take a blanket approach.
552960	557520	I do, and it hasn't hurt me yet, but you've got to make that determination.
558880	573980	Here's the IPs if you want to take a blanket approach. The good news is it's just not a whole lot of statements really, it's some big pieces of network, big slash 8s, and put a statement in your router firewall and drop everything.
573980	594300	I have to add here, Cabot Enter, this list, not necessarily complete, you want to check with IANA and make sure that this is the latest list, and you don't need to jot this down, I don't see anyone writing down anything anyways, it's too late in the day, but it's on the CD and on the website, so you can get all the numbers off of there.
597200	623140	Here is an example if you say you don't want to take that blanket approach, you just want to block China, you also have to take into account that many organizations, suborganizations, within a region may not necessarily have IP space that's assigned to their RIR, they may get it from Aron, they may have applied, they may have an American parent company, or they may have applied a while back, or just, they may have wanted to get that space for another reason.
623140	630980	So, if you really want to be 100% accurate, you've got to go out there and find out all the IP addresses associated with that, including the Aron space.
631540	639960	Here's an example of the China only IP blocking, if you want to do that.
640980	653100	Don't worry, again, don't write all this down, it's on the CD, it's on the website, and I'm going to show you at the end a way to get this front list automatically, so, instead of having to take it all off this presentation.
653100	655980	Here's Korea, same kind of thing.
657460	675080	Europe, Europe's a little bit more of a mixed bag, because you've got a lot of small countries there, there's a lot of governments, there's a lot of multinationals, it's really mixed up over there, and it's pretty hard to block the whole thing, I don't recommend it.
675080	691260	But you can sort of take a couple of countries that are particularly troublesome, such as Russia, and drop that, because a lot of stuff comes out of Russia, and again, a lot of companies aren't necessarily doing business with Russia, needing to provide access to their network to there.
692340	702840	But, if you do want to take it out, there it is, that's the RIPE address space, again, not a whole lot of statements in your router config, type them in and go.
702840	704640	I'll be giving examples at the end.
705460	707680	LACNIC is Latin America and Caribbean.
710380	720000	A lot of these organizations use air and space, again, because they either have a company in the U.S. or they want to, they've established their presence there.
720320	729560	But if you want to take a rifle approach, Brazil and Argentina are the bad, the worst guys, I should say, over there, and you can take those out.
731040	746420	If you're a border company, border state, or you're doing a lot of NAFTA business, you may just want to skip this. I don't block it myself, so it's up to you on how permissive or not you want to be.
747220	753200	Pretty small set of blocks for them at any rate, so pretty easy to block, blanket.
754080	762320	Here's the, these are just examples, again, I'm going to give you guys a tool to get the custom list for your network, but there's the list for Brazil.
763920	778020	AFRINIC, this is a new brewer, and just a lot of bad stuff comes out of here. Not a lot of legitimate commerce being done, unless you're an energy company or maybe a tobacco company.
779420	788400	There's just more or less a lot of offers to transfer $20 million into your bank account for a Nigerian general or something, so you may want to just go ahead and block that.
788400	795540	It's one slash eight, and probably not going to cause you any problems with legitimate commerce.
798040	807620	A couple of strategies you can take towards this, as I mentioned, shotgun approach, just block them all. Just take them all out, and if there's problems, then you can always go back again.
808420	813420	Myself and a lot of companies that I've talked to, they've done it, and it just didn't seem to bother them at all.
813960	822340	So you can block the entire rare space and be done with it. It's easy and quick, but you might end up blocking some countries that you do want to do business with.
822340	829600	Example, Australia, New Zealand does use some of that space. Some sites do, some sites don't, so you need to be careful.
834420	841000	The rifle approach, which is generally what I recommend, is taking country-by-country assignments and saying, I want to take these guys out.
841000	859800	Easiest thing to do, if you want a quick hit, is those top three, China, Taiwan, and South Korea, and get a 20 or 30 percent, lessen the load on your DMZ servers, your mail servers, by 20 to 30 percent, without doing a whole lot of harm to anyone wanting to come in legitimately.
861360	870340	It is time-consuming. You do have to kind of keep up with the configs, but there are some ways to automate that, which I'll show you in a moment, to speed up that process.
872540	891900	You can also take a little more of a limited approach on a protocol level and say, well, I'm only going to block, I'm going to block everything but mail, or everything but mail and web, so the mail servers still function and the web servers still function, but if someone's trying to SSH or telnet, FTP, that stuff gets dropped.
893860	914700	You can also block different segments, so you're going to block anything headed for your private land, but let's leave the DMZ wide open, but you don't really get any spam benefit here, or public server exploit benefit, you get, you know, zombie stuff and things coming into your network, your land, but you're not going to get the server benefit if you do that.
914700	929960	You can decide to go the other way and allow everything, but we're only going to block interactive services, telnet, SSH, things like this, terminal services where someone could get in and possibly do some damage.
931120	941980	You can pick certain servers to block, so you have a VPN server or database server, and you're just going to block it for that specific host or set of hosts, not all your other servers.
943080	964900	We might decide to block the entire RIR, but leave open a certain hotel or ISP web space, sorry, web space, that should be IP space, to allow VPN access if your company has a deal with Hilton and everyone stays at Hilton, you can find out their IPs and not block that.
966820	985480	Some examples, and this is not rocket science, you're all probably familiar with IP chains, just a simple deny statement. You do have to enter one of these for every block, every contiguous block, so you can't, at least in IP chains and IP tables, there's no easy way to block them all with one quick statement.
988660	1001360	This is the IP tables example, ignore that it says IP chain, sorry, I edited this this morning and was not expecting to have to go until Sunday, so there may be some typos, but there's the IP tables example.
1002520	1006580	Cisco, if you're into Cisco, there's the Cisco example.
1009320	1018040	SonicWall, and so on, just whatever particular router or firewall that you happen to like, figure out the syntax and the numbers.
1019660	1034400	Here's an example on IP tables, I was talking about letting web through, so we're using the not operator to deny everything except it's not web, we're going to deny it if it's not web, if it's web, it comes through.
1034980	1039560	And you can add D ports and add additional ports if you want to, web, mail, whatever.
1042280	1045580	Automation, what makes all this make sense?
1046460	1060400	Well, there's a site out there, excellent site, ip.ludos.net, and there's actually a couple of sites, I happen to find this one to be the easiest to use and it's free, and they're not trying to sell you any products.
1061660	1068480	It has a script that will generate country-specific lists and you can import that straight in using the script I'll give you in a minute.
1068800	1076140	You just pull a text file, or you can pull their whole file and parse it yourself if you want to do that, if you want to get fancy with your own script.
1076680	1084520	And there's also commercial companies that will actually generate your configs or your files for you for a fee, if you want to do that.
1084520	1092360	I think one of them is called country, ip2country.com, it's not on there, but that's an example of one of those.
1093260	1105840	Starting to see some, especially in Europe, some ISPs are doing this, large website search engines, we're starting to see some of the bigger companies actually use this technique.
1106980	1113360	Kind of interesting on their part that they would do that, but they're obviously, they see the value in avoiding all that bad stuff.
1116420	1128840	Here's a quickie script, again, forgive me any syntax errors since I jammed this out this morning, but this basically will grab your text file you pulled off Ludost site and drop it into IP tables.
1129680	1139940	Go line by line and create the entry, so all you have to do is grab the file and run the script, you can automate that in cron and, you know, it'll get all your IPs updated.
1139940	1144780	That Ludost site updates daily, so they have pretty current information on them.
1148660	1164580	Resources, this is a good list, a blocking list, this also includes not country specific, but other things like big spammers and so forth, so if you don't want to just do geo, you can also block by types of bad things like spam and so forth.
1164580	1168100	And that's the Ludost IP to country database.
1171900	1178360	Got a little extra for you guys, since you're having to watch this presentation, so the one you're expecting.
1179600	1190460	We were going to originally, we proposed to do a full session on hacker related humor, they did not elect to let us do it, but you guys are going to get it anyway, so I have some extra time.
1190880	1191900	A shortened version.
1192520	1194420	I've got a top ten list for you.
1194940	1200400	This is the top ten pickup lines overheard at DEF CON 13 in the home office.
1200820	1201800	Number ten.
1203100	1205100	Want to go war driving out by the point?
1209750	1212510	Hi, I'm with tech support, can I have your password?
1213590	1215370	That didn't go over very well.
1216290	1218650	I'm serious, I really need your password.
1220010	1222630	Got the password, but no date.
1224370	1228830	Hosting a private version of the TCP IP drinking game later in my room.
1229770	1230970	Just you and me.
1232210	1233610	Hey, snarf this.
1236270	1237590	Number five.
1237590	1239890	Hey, mind if I try to pick the lock on your bra?
1243370	1245890	Try to spot my little federal buddy.
1249130	1252610	Hey, I heard there was a really cool PGP signing over at Caesars.
1252770	1253430	Want to go?
1255850	1258550	Number two, this is for the ladies in the crowd.
1259590	1260870	Figured to give this to you.
1260870	1262070	It's kind of complicated though.
1262070	1263350	You really have to master it.
1263350	1264190	It's difficult.
1265230	1265890	Hi.
1268490	1269290	Works.
1271050	1275010	Finally, number one pickup line overheard at DEF CON 13.
1275710	1278010	Hey, did you know I'm a speaker at DEF CON 13?
1279850	1280810	That's it.
1280810	1284890	If you have any questions on this or anything else,
1284890	1288050	my email is thallett at netsecuritiesservices.com
1288430	1293410	and the presentation will be posted to my site as well as it's on the DEF CON site.
1293790	1297190	And feel free to email me abuse, comments, questions.
1297190	1299730	Any questions right now?
1299730	1301850	Since we're done pretty early.
1302950	1303730	Yes.
1320450	1323430	You said there's...
1323430	1330150	The question was he was blocking Korea and he found legitimate hotmail traffic coming from Korea.
1332030	1334050	Yeah, I've not heard of that.
1334050	1334670	I mean...
1335530	1337430	Yeah, I've not seen that at all.
1337430	1339430	Some people might say that blocking hotmail is...
1339950	1341590	A lot of companies block hotmail anyways.
1341590	1345430	But I block it and I have hotmail and never had a problem.
1345430	1346990	But it's interesting.
1346990	1348490	I'll have to check that out.
1348790	1349470	Yes.
1375240	1376200	Like a...
1377160	1380080	Kind of like a honey net, sort of, kind of.
1385470	1388990	And how do you determine if it's invalid SMTP connections?
1389190	1390930	From those by IP?
1392550	1392910	Or...
1407320	1408040	Okay.
1408500	1411440	So you sort of built a white list of IPs, huh?
1411620	1412480	It's interesting.
1423420	1429040	Yeah, I mean, you can do all kinds of interesting things with your IP table statements about what you do with it and where you send.
1429040	1430260	I mean, drop, deny.
1430520	1433280	And you can get really fancy with it and do fun stuff with it.
1433540	1435740	In the simplest form, you just drop it.
1435740	1436180	But...
1436180	1439880	And again, the scripts can get a lot fancier in terms of the importing.
1439880	1441940	You could actually go out to the website.
1442360	1445520	We could build a PHP script to type in what countries you want to block.
1445520	1446020	You know.
1446120	1448200	We haven't done that because we don't need it.
1448200	1451320	But someone out there could probably whip it up pretty quickly, I'm sure.
1460420	1463100	You blocked all email addresses except for...
1466120	1467000	Huh.
1471560	1472200	Yeah.
1473840	1474720	Yeah.
1474780	1475800	I mean, that would work.
1475800	1477920	You don't get any complaints about that?
1478740	1479420	Good.
1479420	1480340	Good for you.
1480820	1482200	Question back here somewhere?
1485060	1486260	Good question.
1486820	1488140	I don't know.
1488680	1492380	Since it's not really a reality yet, I haven't dealt with that.
1492380	1494580	And again, I don't try to oversell this.
1494580	1496980	This may only work for a year or two.
1497240	1501960	But to me, if it takes me 15 minutes and it works and it does something, it's worth doing.
1501960	1504900	But yeah, I mean, IPv6 could throw a wrench in that.
1504900	1508240	Because I don't think they're going to be assigning things regionally anymore with that.
1508920	1512700	Also, I didn't mention this, but some other fun things you can do with...
1512700	1515360	You can do geo-IP detection.
1516060	1521700	And write some snort rules to detect Chinese IP addresses on your network for some reason.
1521900	1523320	So we've done that too.
1523500	1528740	Well, if it did get through, it's on our network now, let's throw up an alert.
1528740	1532420	So there's some other advanced topics.
1532700	1537700	But again, this is just something down and dirty that you can do that might save you some grief.
1537700	1541780	And anything that lowers the percentage chance of me getting exploited.
1541900	1547620	And that cost is low and the benefit is relatively high, is a good thing to me.
1548120	1549280	Any other questions?
1551540	1552500	Great.
1552660	1554400	Thanks for coming. I really appreciate it.
1554400	1556040	And have a good show.