Tell Me Your IP And I’ll Tell You Who You Are
Noa Bar-Yosef from Imperva talked about using IP addresses to identify attackers – it’s not as old and busted as you may think. She argues that it is still useful to apply IP intelligence to security problems.
Industrialized hacking is a $1T business, not to mention competitive hacking/insiders, corporate espionage… There’s bad people trying to get at you.
“Look at the IP address” has gotten to where it’s not considered useful, due to pooling from ISPs, masquerading, hopping… You certainly can’t use them to prove in court who someone is.
But… home users’ IPs persist 65% more than a day, 15% persist more than a week. A lot of folks don’t go through aggregators, and not all hopping matters (the new IP is still in the same general location). So the new “IP Intelligence” consists of gathering info, analyzing it, and using it intelligently.
Inherent info an IP gives you – its type of allocation, ownership, and geolocation. You can apply reputation-based analytics to them usefully.
Geolocation can give context – you can restrict IPs by location, sure, but also it can provide “why are they hitting that” fraud detection. Are hits from unusual locations, simultaneous from different locations, or from places really different from what the account’s information would indicate? Maybe you can’t block on them – but you can influence fuzzy decisions. Flag for analysis. Trigger adaptive authentication or reduced functionality.
Dynamically allocated addresses aren’t aggregators, and 96% of spam comes from them.
Thwart masquerading – know the relays, blacklist them. Check accept-language headers, response time, path… Services provide “naughty” lists of bad IPs – also, whitelists of good guys. Use realtime blacklist feeds (updated hourly).
Geolocation data can be obtained as a service (Quova) or database (Maxmind). Reputation data is somewhat fragmented by “spammer” or whatnot, and is available from various suppliers (who?)
I had to bail at this point unfortunately… But in general a sound premise, that intel from IPs is still useful and can be used in a general if not specific sense.
the agile admin 