4 ms·
>You're spending time trying to annoy attackers that you should probably just ignore. s/ignore/block at firewall-level/ To me this article is of relevance no
by foul 3y ago
>You're spending time trying to annoy attackers that you should probably just ignore.
s/ignore/block at firewall-level/
To me this article is of relevance nonetheless because It inspires me for messing with AI trainers by crafting an html page ZIP bomb full of ZIP-bomb-like embedded attachments (stylesheets, images, etc).
- berkes 3y agoI use fail2ban for this. I know what my servers run (and it's never PHP, Python microsoft/AD sharepoint etc, because I don't have services in these languages or systems) so I simply fail2ban everything that matches these broad items. Access "wp-admin"? Ban. Try "cron.php" ban. Looking for "phpmyadmin"? ban. It works reasonably well. These bots can switch to other IPs, or try again after the jailtime is lifted (20 mins in my case). But instead of a bot attempting thousands of endpoints, I get only one attempt. I initially configured this on a backend, that for reasons, had to handle every URL in the (Ruby, so heavy and slow) application layer: a bot trying common endpoints for popular CMSes and services, would put severe load on this application. Fail2ban was already there, blocking SSH, FTP, SMTP and whatnot, so I configured it to also handle these HTTP endpoints.
- tlavoie 3y agoFail2ban can also work on ModSecurity logs, banning IPs that trigger a bunch of rules there. By the way, I have mine set to block for 12 hours, and some still come back. I suppose what I should look into is some sort of progressive extension to the delay.
- berkes 3y agoA progressive jailtime is, indeed, a very good idea.
- hannob 3y agoNo, ignore. WAFs that "block" "attacks" that ultimately should just cause a 404 error are part of the same mindset: That you think you "have to do something" about an attack that you should probably just ignore. They're also part of the mindset that security should mean adding more complexity, which is the opposite of what you should do.
- lifthrasiir 3y agoI would like to compare this to dealing with unsolicited robocalls. Most would just ignore them, and it's indeed an unwise choice to accept them. But some try to strategically waste the caller's time by only accepting and doing nothing else. I can't say whether it's beneficial or not, but I can say that it is easy enough to do without worrying too much.
- KineticLensman 3y agoExcept that you are giving away your voice as training data
- lifthrasiir 3y agoDoing nothing includes not saying anything, of course.
- nico_h 3y agoSometimes you’ve been aggravated for so long that doing something might be worth it for your own sense of balance.
- foul 3y agoNo, block at firewall-level. I never implied you should have to "study", "scan" the attacker's request: drop it. You don't owe net-neutrality to a botnet instance. That's just for when you should need to be clever, as in when you are tasked to be a sysadmin for, like, an hosting service or a corporate network, so you're not really aware of everything coming and going through. If you're just a self-hoster you should not be clever, neither at ingress nor at egress: you "just" have to minimize attack surface because you probably know what you want to offer, e.g. for a blog you can publish with a SSG or serve HTML pages scraped from a dynamic CMS you'd like to use, like Wordpress, instead of serving the CMS' contents directly (and deal with comments using something else).