WEBVTT 01:36.350 --> 01:48.030 I work at a network consulting company, got a bunch of letters after my name, wrote a book and been doing this a while, so a little bit familiar with IP networks. 01:49.270 --> 01:51.190 What is geo-IP blocking? 01:51.190 --> 02:04.410 Just like it sounds, it's taking big chunks of IPs and blocking them from your network indiscriminately, for no reason other than where they come from, geographically, on your firewall or it works on routers too. 02:07.150 --> 02:09.290 Just some statistics for you. 02:09.730 --> 02:17.230 This is a study done by Spamhaus of the top spamming countries and I'm not giving you the whole list here, but these are the top three. 02:17.370 --> 02:19.830 No surprise, USA is number one. 02:19.830 --> 02:22.950 We love to be number one at everything, this is no exception. 02:23.730 --> 02:38.810 But right behind us is South Korea, China, Taiwan right behind that, so there's a number of countries that this is concentrated in, adds up to about 21% for just those two. 02:38.810 --> 02:43.170 This is just spam, but it's an example of where that stuff's coming from. 02:43.170 --> 02:45.790 Why do this? 02:47.070 --> 02:49.550 First reason is it's easy, it's quick. 02:49.970 --> 02:53.630 You don't have to buy any new hardware or software, you can just put some entries in your router. 02:54.310 --> 02:56.530 Again, no cost, just typing it in. 02:56.870 --> 03:02.670 You might have to spend some labor to type in some of the larger blocks, but it's still not a whole lot of investment. 03:02.670 --> 03:16.690 You also enable you to sort of blanket avoid all kinds of attacks, not just spam or viruses or worms, we just drop everything, period, forget it. 03:16.830 --> 03:19.330 We're just not going to accept anything from those areas. 03:19.490 --> 03:26.370 It's easily reversible, so if you don't like it or it's not working, it's causing problems on your network, take it out and you're back to where you started. 03:26.370 --> 03:31.610 So you don't have to un-configure the software or take pieces of hardware off your network. 03:32.410 --> 03:36.630 Users can still get to the websites in those countries. 03:36.630 --> 03:40.410 We're blocking inbound connections, we're not necessarily blocking outbound. 03:40.410 --> 03:46.210 You can block outbound, that gives some additional benefits, but also some additional potential problems. 03:46.210 --> 03:48.430 So the option is there for you. 03:49.630 --> 03:56.450 Most companies, let's face it, don't need to have these countries accessing their network. 03:56.450 --> 04:11.910 Fortune 500 companies, that's not necessarily the case, but there's a lot of other companies out there that don't necessarily want or need to do business with these countries and there's no reason to accept inbound connections from these locations. 04:12.390 --> 04:27.590 And again, even Fortune 500 can use this on a limited basis for certain types of servers, things that, internal intranets, things like that, that aren't, they're not going to be people connecting inbound, you can still open up your website, email server and so forth. 04:27.590 --> 04:30.710 So it's not just for small companies, medium-sized companies. 04:31.450 --> 04:32.750 More reasons. 04:33.630 --> 04:37.910 Over time, more and more stuff will probably move offshore from the U.S. 04:37.910 --> 04:38.270 The U.S. 04:38.270 --> 04:49.950 is still just a big part of the internet and still generates most of the traffic, but as time goes on, we'll probably see that the problem or the solution would ever get worse or better. 04:50.910 --> 05:00.130 It also has the effect, similar to spamming blacklists, of forcing bad actor countries, as I call them, to take some actions. 05:00.130 --> 05:03.670 And this, in fact, has happened with China and spam. 05:03.670 --> 05:17.410 They've recently introduced some laws and arrested some people and God knows what in their usual way, but still they're taking action and starting to become more of a good net citizen because of this pressure. 05:20.290 --> 05:22.150 What can this help with? 05:22.150 --> 05:28.150 Well, as I was saying before, it's sort of a blanket approach so it can block spam, of course, was our example. 05:28.370 --> 05:37.330 Email fraud coming out of those locales, phishing attempts, viruses, worms, automated hacking tools, manual hacking, mostly script kitties. 05:37.350 --> 05:40.850 I know you can spoof the addresses and do all kinds of fun stuff like that. 05:40.850 --> 05:46.530 If someone's really concerned about getting to your servers, they can manage to do so, even with this. 05:46.530 --> 05:52.050 But, as we know, 90% of the stuff out there or more is kind of dumb and doesn't do that. 05:52.490 --> 06:00.090 And also, I say, prohibited off-site content, porn, gambling, if you block the outbound connections from your network. 06:04.060 --> 06:05.440 Why not? 06:05.600 --> 06:07.440 Well, one does not make sense. 06:07.440 --> 06:09.980 It's not 100% effective, what is. 06:09.980 --> 06:13.380 But if you're looking for a silver bullet, whatever, this is not it. 06:13.380 --> 06:18.340 This is just yet another tool, another layer to help with your security protections. 06:19.480 --> 06:26.040 Some people may have a problem with it in that it goes against the idea of global access to everything all the time. 06:27.100 --> 06:33.580 And again, if you're a big company, you probably can't do this on your public servers or web, your email. 06:34.680 --> 06:46.980 Or if you're even a small company, say, doing business in Japan or overseas areas, however, you can still block, say, China, if you're doing business in Europe or elsewhere, you can still take the effort to block the bad guys. 06:47.860 --> 06:52.720 And again, it's going to block emails and things like that as well. 06:52.720 --> 06:59.780 So, if you're expecting to get legitimate business email, you don't want to block it or you want to take a more limited approach. 06:59.780 --> 07:06.240 Example, my company, we primarily deal with community banks in Texas. 07:06.400 --> 07:13.740 There's very, very, very low possibility of anyone trying to do legitimate business with any of those countries with me. 07:13.740 --> 07:18.000 Frankly, if I had one customer who wanted to do business over there, I don't want them. 07:18.080 --> 07:21.060 So, in my case, it makes a lot of sense. 07:23.800 --> 07:25.040 How it works. 07:25.740 --> 07:27.500 Let's start at the very top level. 07:27.500 --> 07:42.440 Some of y'all may already know this, but IANA assigns out big address blocks to what's called the regional internet registries, or RIRs, that handle more regions, continents, what have you, and they handle assigning things regionally. 07:43.380 --> 07:46.940 ARIN is the RIR that handles North America. 07:47.380 --> 07:51.840 Has anyone ever had to file for IP space with Dennis Swift? 07:52.160 --> 07:53.500 Yeah, a lot of fun, right? 07:53.600 --> 07:56.060 So, you know all about ARIN and how they work. 07:58.940 --> 08:08.660 Other RIRs that we'll talk about primarily, because ARIN is not part of this talk, we don't want to block ARIN, otherwise we'd be blocking ourselves and most of the other stuff that we want to get to. 08:08.660 --> 08:27.900 But some of the other RIRs that may be of interest, APNIC, which is Asia, Asia Pacific Network Information Center, RIPE, which is Europe and part of the Middle East and Central Asia, LACNIC, Latin America, and AFRINIC, which is a new RIR that just got assigned for Africa. 08:29.660 --> 08:36.540 Talk about some of the RIRs specifically and which ones make less or more sense to block. 08:36.580 --> 08:47.480 APNIC, Asia, as I said, now this takes in several of my top bad actor countries, number 2 and number 3 spammers, for example. 08:47.480 --> 09:00.480 Just by blocking APNIC, and this is an example that I've proved to myself, you can end up blocking about 20 to 30% of your malware headed for your public servers just from APNIC, because so much stuff comes out of that region. 09:02.460 --> 09:12.960 However, be careful, if you do a blanket lock, Japan, a lot of business gets done over there and some other areas, so you may not want to take a blanket approach. 09:12.960 --> 09:17.520 I do, and it hasn't hurt me yet, but you've got to make that determination. 09:18.880 --> 09:22.020 Here's the IPs if you want to take a blanket approach. 09:22.220 --> 09:33.980 The good news is it's just not a whole lot of statements really, it's some big pieces of network, big slash 8s, and put a statement in your router firewall and drop everything. 09:33.980 --> 09:49.740 I have to add here, Cabot Enter, this list, not necessarily complete, you want to check with IANA and make sure that this is the latest list, and you don't need to jot this down, I don't see anyone writing down anything anyways, it's too late in the day, 09:49.740 --> 09:54.300 but it's on the CD and on the website, so you can get all the numbers off of there. 09:57.200 --> 10:14.320 Here is an example if you say you don't want to take that blanket approach, you just want to block China, you also have to take into account that many organizations, suborganizations, within a region may not necessarily have IP space that's assigned to their RIR, 10:14.320 --> 10:23.140 they may get it from Aron, they may have applied, they may have an American parent company, or they may have applied a while back, or just, they may have wanted to get that space for another reason. 10:23.140 --> 10:30.980 So , if you really want to be 100% accurate, you've got to go out there and find out all the IP addresses associated with that, including the Aron space. 10:31.540 --> 10:39.960 Here's an example of the China only IP blocking, if you want to do that. 10:40.980 --> 10:53.100 Don't worry, again, don't write all this down, it's on the CD, it's on the website, and I'm going to show you at the end a way to get this front list automatically, so, instead of having to take it all off this presentation. 10:53.100 --> 10:55.980 Here's Korea, same kind of thing. 10:57.460 --> 11:15.080 Europe, Europe's a little bit more of a mixed bag, because you've got a lot of small countries there, there's a lot of governments, there's a lot of multinationals, it's really mixed up over there, and it's pretty hard to block the whole thing, I don't recommend it. 11:15.080 --> 11:31.260 But you can sort of take a couple of countries that are particularly troublesome, such as Russia, and drop that, because a lot of stuff comes out of Russia, and again, a lot of companies aren't necessarily doing business with Russia, needing to provide access to their network to there. 11:32.340 --> 11:42.840 But, if you do want to take it out, there it is, that's the RIPE address space, again, not a whole lot of statements in your router config, type them in and go. 11:42.840 --> 11:44.640 I'll be giving examples at the end. 11:45.460 --> 11:47.680 LACNIC is Latin America and Caribbean. 11:50.380 --> 11:56.500 A lot of these organizations use air and space, again, because they either have a company in the U.S. 11:56.500 --> 12:00.000 or they want to, they've established their presence there. 12:00.320 --> 12:09.560 But if you want to take a rifle approach, Brazil and Argentina are the bad, the worst guys, I should say, over there, and you can take those out. 12:11.040 --> 12:19.180 If you're a border company, border state, or you're doing a lot of NAFTA business, you may just want to skip this. 12:19.620 --> 12:26.420 I don't block it myself, so it's up to you on how permissive or not you want to be. 12:27.220 --> 12:33.200 Pretty small set of blocks for them at any rate, so pretty easy to block, blanket. 12:34.080 --> 12:42.320 Here's the, these are just examples, again, I'm going to give you guys a tool to get the custom list for your network, but there's the list for Brazil. 12:43.920 --> 12:51.840 AFRINIC, this is a new brewer, and just a lot of bad stuff comes out of here. 12:51.920 --> 12:58.020 Not a lot of legitimate commerce being done, unless you're an energy company or maybe a tobacco company. 12:59.420 --> 13:08.400 There's just more or less a lot of offers to transfer $20 million into your bank account for a Nigerian general or something, so you may want to just go ahead and block that. 13:08.400 --> 13:15.540 It's one slash eight, and probably not going to cause you any problems with legitimate commerce. 13:18.040 --> 13:24.080 A couple of strategies you can take towards this, as I mentioned, shotgun approach, just block them all. 13:24.080 --> 13:27.620 Just take them all out, and if there's problems, then you can always go back again. 13:28.420 --> 13:33.420 Myself and a lot of companies that I've talked to, they've done it, and it just didn't seem to bother them at all. 13:33.960 --> 13:37.380 So you can block the entire rare space and be done with it. 13:37.580 --> 13:42.340 It's easy and quick, but you might end up blocking some countries that you do want to do business with. 13:42.340 --> 13:46.460 Example, Australia, New Zealand does use some of that space. 13:46.460 --> 13:49.600 Some sites do, some sites don't, so you need to be careful. 13:54.420 --> 14:01.000 The rifle approach, which is generally what I recommend, is taking country-by-country assignments and saying, I want to take these guys out. 14:01.000 --> 14:19.800 Easiest thing to do, if you want a quick hit, is those top three, China, Taiwan, and South Korea, and get a 20 or 30 percent, lessen the load on your DMZ servers, your mail servers, by 20 to 30 percent, without doing a whole lot of harm to anyone wanting to come in legitimately. 14:21.360 --> 14:22.800 It is time-consuming. 14:22.800 --> 14:30.340 You do have to kind of keep up with the configs, but there are some ways to automate that, which I'll show you in a moment, to speed up that process. 14:32.540 --> 14:47.440 You can also take a little more of a limited approach on a protocol level and say, well, I'm only going to block, I'm going to block everything but mail, or everything but mail and web, so the mail servers still function and the web servers still function, 14:47.440 --> 14:51.900 but if someone's trying to SSH or telnet, FTP, that stuff gets dropped. 14:53.860 --> 15:10.320 You can also block different segments, so you're going to block anything headed for your private land, but let's leave the DMZ wide open, but you don't really get any spam benefit here, or public server exploit benefit, you get, you know, zombie stuff and things coming into your network, 15:10.320 --> 15:14.700 your land, but you're not going to get the server benefit if you do that. 15:14.700 --> 15:29.960 You can decide to go the other way and allow everything, but we're only going to block interactive services, telnet, SSH, things like this, terminal services where someone could get in and possibly do some damage. 15:31.120 --> 15:41.980 You can pick certain servers to block, so you have a VPN server or database server, and you're just going to block it for that specific host or set of hosts, not all your other servers. 15:43.080 --> 16:04.900 We might decide to block the entire RIR, but leave open a certain hotel or ISP web space, sorry, web space, that should be IP space, to allow VPN access if your company has a deal with Hilton and everyone stays at Hilton, you can find out their IPs and not block that. 16:06.820 --> 16:14.380 Some examples, and this is not rocket science, you're all probably familiar with IP chains, just a simple deny statement. 16:15.020 --> 16:25.480 You do have to enter one of these for every block, every contiguous block, so you can't, at least in IP chains and IP tables, there's no easy way to block them all with one quick statement. 16:28.660 --> 16:41.360 This is the IP tables example, ignore that it says IP chain, sorry, I edited this this morning and was not expecting to have to go until Sunday, so there may be some typos, but there's the IP tables example. 16:42.520 --> 16:46.580 Cisco, if you're into Cisco, there's the Cisco example. 16:49.320 --> 16:58.040 SonicWall, and so on, just whatever particular router or firewall that you happen to like, figure out the syntax and the numbers. 16:59.660 --> 17:14.400 Here's an example on IP tables, I was talking about letting web through, so we're using the not operator to deny everything except it's not web, we're going to deny it if it's not web, if it's web, it comes through. 17:14.980 --> 17:19.560 And you can add D ports and add additional ports if you want to, web, mail, whatever. 17:22.280 --> 17:25.580 Automation, what makes all this make sense? 17:26.460 --> 17:40.400 Well, there's a site out there, excellent site, ip.ludos.net, and there's actually a couple of sites, I happen to find this one to be the easiest to use and it's free, and they're not trying to sell you any products. 17:41.660 --> 17:48.480 It has a script that will generate country-specific lists and you can import that straight in using the script I'll give you in a minute. 17:48.800 --> 17:56.140 You just pull a text file, or you can pull their whole file and parse it yourself if you want to do that, if you want to get fancy with your own script. 17:56.680 --> 18:04.520 And there's also commercial companies that will actually generate your configs or your files for you for a fee, if you want to do that. 18:04.520 --> 18:12.360 I think one of them is called country, ip2country.com, it's not on there, but that's an example of one of those. 18:13.260 --> 18:25.840 Starting to see some, especially in Europe, some ISPs are doing this, large website search engines, we're starting to see some of the bigger companies actually use this technique. 18:26.980 --> 18:33.360 Kind of interesting on their part that they would do that, but they're obviously, they see the value in avoiding all that bad stuff. 18:36.420 --> 18:48.840 Here's a quickie script, again, forgive me any syntax errors since I jammed this out this morning, but this basically will grab your text file you pulled off Ludost site and drop it into IP tables. 18:49.680 --> 18:59.940 Go line by line and create the entry, so all you have to do is grab the file and run the script, you can automate that in cron and, you know, it'll get all your IPs updated. 18:59.940 --> 19:04.780 That Ludost site updates daily, so they have pretty current information on them. 19:08.660 --> 19:24.580 Resources, this is a good list, a blocking list, this also includes not country specific, but other things like big spammers and so forth, so if you don't want to just do geo, you can also block by types of bad things like spam and so forth. 19:24.580 --> 19:28.100 And that's the Ludost IP to country database. 19:31.900 --> 19:38.360 Got a little extra for you guys, since you're having to watch this presentation, so the one you're expecting. 19:39.600 --> 19:50.460 We were going to originally, we proposed to do a full session on hacker related humor, they did not elect to let us do it, but you guys are going to get it anyway, so I have some extra time. 19:50.880 --> 19:51.900 A shortened version. 19:52.520 --> 19:54.420 I've got a top ten list for you. 19:54.940 --> 20:00.400 This is the top ten pickup lines overheard at DEF CON 13 in the home office. 20:00.820 --> 20:01.800 Number ten. 20:03.100 --> 20:05.100 Want to go war driving out by the point? 20:09.750 --> 20:12.510 Hi, I'm with tech support, can I have your password? 20:13.590 --> 20:15.370 That didn't go over very well. 20:16.290 --> 20:18.650 I'm serious, I really need your password. 20:20.010 --> 20:22.630 Got the password, but no date. 20:24.370 --> 20:28.830 Hosting a private version of the TCP IP drinking game later in my room. 20:29.770 --> 20:30.970 Just you and me. 20:32.210 --> 20:33.610 Hey, snarf this. 20:36.270 --> 20:37.590 Number five. 20:37.590 --> 20:39.890 Hey, mind if I try to pick the lock on your bra? 20:43.370 --> 20:45.890 Try to spot my little federal buddy. 20:49.130 --> 20:52.610 Hey, I heard there was a really cool PGP signing over at Caesars. 20:52.770 --> 20:53.430 Want to go? 20:55.850 --> 20:58.550 Number two, this is for the ladies in the crowd. 20:59.590 --> 21:00.870 Figured to give this to you. 21:00.870 --> 21:02.070 It's kind of complicated though. 21:02.070 --> 21:03.350 You really have to master it. 21:03.350 --> 21:04.190 It's difficult. 21:05.230 --> 21:05.890 Hi. 21:08.490 --> 21:09.290 Works. 21:11.050 --> 21:15.010 Finally, number one pickup line overheard at DEF CON 13. 21:15.710 --> 21:18.010 Hey, did you know I'm a speaker at DEF CON 13? 21:19.850 --> 21:20.810 That's it. 21:20.810 --> 21:33.410 If you have any questions on this or anything else, my email is thallett at netsecuritiesservices.com and the presentation will be posted to my site as well as it's on the DEF CON site. 21:33.790 --> 21:37.190 And feel free to email me abuse, comments, questions. 21:37.190 --> 21:39.730 Any questions right now? 21:39.730 --> 21:41.850 Since we're done pretty early. 21:42.950 --> 21:43.730 Yes. 22:00.450 --> 22:03.430 You said there's... 22:03.430 --> 22:10.150 The question was he was blocking Korea and he found legitimate hotmail traffic coming from Korea. 22:12.030 --> 22:14.050 Yeah, I've not heard of that. 22:14.050 --> 22:14.670 I mean... 22:15.530 --> 22:17.430 Yeah, I've not seen that at all. 22:17.430 --> 22:19.430 Some people might say that blocking hotmail is... 22:19.950 --> 22:21.590 A lot of companies block hotmail anyways. 22:21.590 --> 22:25.430 But I block it and I have hotmail and never had a problem. 22:25.430 --> 22:26.990 But it's interesting. 22:26.990 --> 22:28.490 I'll have to check that out. 22:28.790 --> 22:29.470 Yes. 22:55.240 --> 22:56.200 Like a... 22:57.160 --> 23:00.080 Kind of like a honey net, sort of, kind of. 23:05.470 --> 23:08.990 And how do you determine if it's invalid SMTP connections? 23:09.190 --> 23:10.930 From those by IP? 23:12.550 --> 23:12.910 Or... 23:27.320 --> 23:28.040 Okay. 23:28.500 --> 23:31.440 So you sort of built a white list of IPs, huh? 23:31.620 --> 23:32.480 It's interesting. 23:43.420 --> 23:49.040 Yeah, I mean, you can do all kinds of interesting things with your IP table statements about what you do with it and where you send. 23:49.040 --> 23:50.260 I mean, drop, deny. 23:50.520 --> 23:53.280 And you can get really fancy with it and do fun stuff with it. 23:53.540 --> 23:55.740 In the simplest form, you just drop it. 23:55.740 --> 23:56.180 But... 23:56.180 --> 23:59.880 And again, the scripts can get a lot fancier in terms of the importing. 23:59.880 --> 24:01.940 You could actually go out to the website. 24:02.360 --> 24:05.520 We could build a PHP script to type in what countries you want to block. 24:05.520 --> 24:06.020 You know. 24:06.120 --> 24:08.200 We haven't done that because we don't need it. 24:08.200 --> 24:11.320 But someone out there could probably whip it up pretty quickly, I'm sure. 24:20.420 --> 24:23.100 You blocked all email addresses except for... 24:26.120 --> 24:27.000 Huh. 24:31.560 --> 24:32.200 Yeah. 24:33.840 --> 24:34.720 Yeah. 24:34.780 --> 24:35.800 I mean, that would work. 24:35.800 --> 24:37.920 You don't get any complaints about that? 24:38.740 --> 24:39.420 Good. 24:39.420 --> 24:40.340 Good for you. 24:40.820 --> 24:42.200 Question back here somewhere? 24:45.060 --> 24:46.260 Good question. 24:46.820 --> 24:48.140 I don't know. 24:48.680 --> 24:52.380 Since it's not really a reality yet, I haven't dealt with that. 24:52.380 --> 24:54.580 And again, I don't try to oversell this. 24:54.580 --> 24:56.980 This may only work for a year or two. 24:57.240 --> 25:01.960 But to me, if it takes me 15 minutes and it works and it does something, it's worth doing. 25:01.960 --> 25:04.900 But yeah, I mean, IPv6 could throw a wrench in that. 25:04.900 --> 25:08.240 Because I don't think they're going to be assigning things regionally anymore with that. 25:08.920 --> 25:12.700 Also, I didn't mention this, but some other fun things you can do with... 25:12.700 --> 25:15.360 You can do geo-IP detection. 25:16.060 --> 25:21.700 And write some snort rules to detect Chinese IP addresses on your network for some reason. 25:21.900 --> 25:23.320 So we've done that too. 25:23.500 --> 25:28.740 Well, if it did get through, it's on our network now, let's throw up an alert. 25:28.740 --> 25:32.420 So there's some other advanced topics. 25:32.700 --> 25:37.700 But again, this is just something down and dirty that you can do that might save you some grief. 25:37.700 --> 25:41.780 And anything that lowers the percentage chance of me getting exploited. 25:41.900 --> 25:47.620 And that cost is low and the benefit is relatively high, is a good thing to me. 25:48.120 --> 25:49.280 Any other questions? 25:51.540 --> 25:52.500 Great. 25:52.660 --> 25:53.360 Thanks for coming. 25:53.360 --> 25:54.400 I really appreciate it. 25:54.400 --> 25:56.040 And have a good show.