SANS ISC: Blocklists - make the right choice - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

I have used real-time blocklists myself since a dozen or so years ago.  I've worked for companies and managed servers that have been listed on blocklists more than once unwarranted. I can't help but notice some huge changes between the granddaddy lists I did support and some of the current breed I'd stay away of.

As with all things the most negative experiences will stand out, but there's a lesson to be learned in how to detect the "bad" blocklists and how to avoid them.

The unintentional user

First, how do you know you are using a blocklist? You don't, unless you start to hunt for it. E.g. your google toolbar has a blocklist of sites it thinks are a bad idea to surf to^(*). It'll warn you about a supposedly bad website you really might be willing to avoid. But how many more blocklists are you using without having intentionally configured, chosen and vetted the processes behind it?

If you use e.g. a sendmail configuration file that you didn't write, how do you know it isn't using some blocklist to tune down the volume of spam.

If you're an unintentional user, you're not in control of the choices being made and you and your peers might in the end suffer badly. So the advise is to seek out what blocklists you are using and go from the unintentional to the intentional user.

False positives - false negatives

True positives and true negatives will mostly go unnoticed but the other two can be problematic. A false positive is e.g. a blocklist for spammers that contains well behaving Internet users. Those users (might be your supplier, your customers, ...) can't communicate anymore with you, and might give up on you as you just seem to be ignoring them rudely.

The false negatives are what will prompt some into searching ever more strict rules as there is still spam sneaking through. We know that getting ever more strict measures will also increase the false positives rate dramatically.

For things like spam where the spam outnumbers the genuine messages dramatically if your address is well known, getting spam free with a blocklist is likely to cost you most if not all genuine messages as well. Basically blocking all email will guarantee you no false negatives, but it'll also guarantee all genuine messages turn out to be false positives.

Measuring false negatives is terribly easy for e.g. spam lists, while measuring false negatives is next to impossible. Just measuring how much email got blocked says nothing about it all, and if you need to read the messages in order to be able to measure the effectiveness , you might just as well deleted the spam by hand.

Criteria

Some criteria we could suggest to choose blocklists:

• Speed of reaction: The faster (the more real-time) a list is updated, the more easier it is to deal with false positives and with false negatives.
• Selection criteria: How are the sources added to the blocklist, based on what criteria ? How sure are the blocklist admins that the one they are listing is bad ? How sure are you they will not add yur partners, customers, suppliers and other business critical peers. Similarly how sure are you they will not list yourself (from experience: this is extremely painful)
• Goal of the blocklist: Does the list have an agenda (hidden or not) that you might not share with them? Do they aim to have 0 false negatives without care for false positives?
• Ease of getting unlisted: How easy is it to contact the list administration for those listed ? If it's e.g. a spam blocking list. Chances are it can't be done in email as they will be using their own blocklist. Is there 24x7 (remember the Internet is worldwide so thy need to cover all timezones) support on getting back out for those unjustly listed ?
• Try contacting them to get unlisted: if you cannot reach them, remember what your communicating partner that got listed by accident will feel like. And while it might reflect mostly on the blocklist provider, it will also reflect on you and your organization due to your choice and implicit support of their (failing) processes.
• Is there somebody who feels responsible enough behind it to put up out of band contact details such as phone numbers, working snail-mail addresses etc. Of course this means they'll feel exposed to the scam artists they are blocking, but it also means those being blocking without reason have a way to complain.
• Blocking for the right reasons. E.g. some anti-spam lists are blocking with as reason the IP addresses sent unwanted TCP/IP traffic (not just unwanted email). Some might have political reasons or other things you don't want to be associated with.
• Duration of a block: many IP addresses that get infected by bots etc. are home users on a (somewhat) dynamic IP address. Blocking sch an IP address for a long time won't help as the IP isn't fixed and the next one to come after it will get blocked unwarranted. Similarly, infected machines do eventually get cleaned up by the rightful owners. So short durations are better.
• Granularity of the block. Unless there are clear signs of malice, most regular users will clean up intrusions and malware instead of hopping about the IP address in an address space to avoid blocklists. Hence only very bad neighborhoods should get blocked indiscriminately. Similarly "punishing" an ISP for having a single misbehaving customer will not work as the ISPs is hardly punished at all, it's the other (innocent) customers of the ISP that get hit.
  While there are people going to say they only deal with a specific country/continent and don't need anything outside, think a bit longer: none of the employees of your partners, customers, ... will ever go out of the country/continent on business or holiday and get a phone call to do something or try to make a decision on the road.
• One practice I found to be impossible to deal with from an business point of view: was a blocklist demanding money to get unlisted. Any self-respecting business will feel this is extortion and will not give in. No matter that they send it to their charity of choice, no matter the small amount it actually is, this remains a show stopper. For you this means you'll find contacts who get listed and have no way of getting out again.
• Do the blocklist administrators actually warn those getting listed? Since many of the evil actions a machine does is more often than not done without the knowledge of the rightful owner, a word to the ISP connecting the machine or the business hosting the machine, can in fact be a big step towards detecting the rootkitted botnet and starting the clean-up.

If your favorite blocklist fails many of these criteria, perhaps it's time to urgently switch blocklists, or move to another solution as to avoid the false positives you might not be aware of.

Sometimes just reading the FAQ wil set of so many alarms that you might choose not to use their blocklist.

If you have more criteria to suggest, feel free, we'll update the story with the best suggestions. 

(*): I've never seen a false positive on the google toolbar myself, so I'm not criticizing them, just using it as one of the examples where you or your users might have picked up a blocklist without having the intention of doing so.

--
Swa Frantzen -- NET2S