RE: Filtering by client IP address for Web App Sessions

["Evans, Arian" <Arian.Evans () fishnetsecurity com>]

That's interesting, but not a viable solution for the enterprise in the US.
Similar problems arise with multiple DoS solutions; think 'SynDefender'.

Apparently I mislead most but the use of the word 'filter'. Let's back up:

Repeatedly on this list and repeatedly IRL I have listened to people
recommend "track source" via mechanism X (header, IP packet,
whatever) for state management. This is done in various forms beyond
a simple IP in a state table; examples are things like a seed for a hashed
session token shoved in a cookie or elsewhere so the focus is not
really _on_the_IP_  *but*  _on_the_IP_changing_.

This has nothing to do with spoofing src which is just as easy to do
with SYN or UDP as it always was, and just as complicated to do for
a valid HTTP/SSL session as it has always been, though CISSPs
around the world are still quick to point out "you could spoof source"
regardless of protocol, condition, and ever having attempted it.

This also has nothing to do with NAT or PAT. I am talking about
SRC-swapping proxies and other mid-session SRC changes.

I have maintained that one should not and cannot use SRC IP for
session handling purposes because there are too many load balancing
issues, possibly BGP failover conditions, and dynamic megaproxies or
whatever you'd like to call them, that can cause IP SRC to dynamically
shift mid-session across entire netblocks as large as /8's and /16's.

They are out there, and there's enough of them to cause trouble if
an important part of your user population sources from them, and if
you've worked with enterprise applications for end users in the USA
you've had to deal with them. I've seen a small bit from Europe too,
and blocking them is simply not an option if they are your clients.

All I want to know is "how common is this abroad?"

I know there are a lot of countries that have ISPs doing this besides
"stupid Americans" and I know why we started doing this a long
time ago when Al Gore invented the Internet and it was completely
valid. I also suspect we might see this in emerging markets due to
economic factors (e.g.-Peru, Bolivia, Thailand, etc.) but this is purely
speculation on my part.

I appreciate very much those of you in-thread and off-line who
helped me out here, particularly those from countries whose traffic
I have little or no insight into.

Thanks again,

-ae

  

> -----Original Message-----
> From: Paul Johnston [mailto:paul () westpoint ltd uk] 
> Sent: Monday, February 28, 2005 9:19 AM
> To: Steve Shah
> Cc: webappsec () securityfocus com
> Subject: Re: Filtering by client IP address for Web App Sessions
>
>
> Hi,
>
> > > From a filtering perspective, it's a great way to reverse DoS a 
> > site doing any kind of source IP based filtering. An attacker
> > needs to only launch an attack (even a trivial one) from behind
> > a significant NAT/proxy server that has a lot of users behind it
> > and if the site bans the IP, it ends up banning a significant 
> > number of users. In the US/AOL case, that could be a serious
> > segment of your user population. 
> This is an interesting problem.
>
> While I advocate never using the IP address as part of session 
> tracking, 
> one use of the source IP address I do condone is 
> mod_dosevasive. This is 
> an Apache module that does some IP address based DoS protection; I 
> imagine other web servers have similar functionality. Now, the 
> choice is 
> either use mod_dosevasive based on IP addresses, or don't use 
> it at all. 
> I reckon using it is better than not. Sure an attacker could 
> bypass the 
> restrictions to some extent by connecting from many IP addresses - but 
> this definitily does raise the bar for attack.
>
> So, the negative is the risk of a proxy user causing a DoS 
> against other 
> users of the same proxy. Well, I reckon in that case it's the 
> responsibility of the proxy administrator to deal with the offending 
> user. In general if you let someone do stuff coming from your IP 
> address, you take on some amount of responsibility for their actions. 
> Another thing to consider is that this way only that one proxy is 
> DoS'ed. If there server has all its resources consumer, it is 
> the entire 
> Internet that is DoS'ed.
>
> Best wishes,
>
> Paul
>
> -- 
> Paul Johnston, GSEC
> Internet Security Specialist
> Westpoint Limited
> Albion Wharf, 19 Albion Street,
> Manchester, M1 5LN
> England
> Tel: +44 (0)161 237 1028
> Fax: +44 (0)161 237 1031
> email: paul () westpoint ltd uk
> web: www.westpoint.ltd.uk