mod-security-users

[mod-security-users] ModSec / CRS: Use of GeoIP & ASN information

[Christian F. <chr...@ne...>]

Hi there,

During the years, I have found the use of GeoIP (& ASN) information in 
#ModSecurity / @CoreRuleSet very useful. Yet very few people do 
this for GeoIP and practically nobody for ASN. 

It really helps to weed out false positives or defend in case of certain 
persistent attacks.

Since good documentation on the subject is scare, here is how to get this 
into your setup:

https://www.netnea.com/cms/2022/10/12/using-geoip-information-together-with-modsecurity/(Also covered in my 2nd webcast last week: https://www.youtube.com/watch?v=OBVwdqEFmX0)

I have also covered this in my 2nd ModSec / CRS webcast last week (plus some
additional interesting stuff):
https://www.youtube.com/watch?v=OBVwdqEFmX0

Best,

Christian


-- 
Ultimately, motivation gets us started, 
but discipline and habit are what enable us to finish.
-- Matthew Helmke

Re: [mod-security-users] ModSec / CRS: Use of GeoIP & ASN information

[Joel W. <jo...@jo...>]

Thanks Christian! I enjoyed the article.

I agree that ASN is underrated - I get a lot of scans from well-known and generally reputable cloud providers which operate in multiple countries, and blocking these providers seems like a much safer way to avoid false positives than doing it by country. However there is still a risk that people are using personal VPSes to run proxies or have good reasons to use services like Tor. While this is probably not a very significant proportion of people I’m reluctant to block access to customer sites outright with no recourse for these users. On the other hand, blocking access by these ASNs to specific resources like the WordPress wp-login.php page would probably be OK.

One idea I’m toying with is creating an interstitial page similar to Cloudflare’s “Checking your browser..” page. For ASNs which are problematic it would be a bit safer to force someone to perform a hCaptcha or something check before they can get through to the intended site and set a cookie. I think this might be possible but a little bit difficult to create entirely using mod_security though, so I’m thinking about writing a new (and relatively simple) Apache module. I’d love to hear if someone has already done this!

Joel

> On 19 Oct 2022, at 12:04 am, Christian Folini <chr...@ne...> wrote:
> 
> Hi there,
> 
> During the years, I have found the use of GeoIP (& ASN) information in 
> #ModSecurity / @CoreRuleSet very useful. Yet very few people do 
> this for GeoIP and practically nobody for ASN. 
> 
> It really helps to weed out false positives or defend in case of certain 
> persistent attacks.
> 
> Since good documentation on the subject is scare, here is how to get this 
> into your setup:
> 
> https://www.netnea.com/cms/2022/10/12/using-geoip-information-together-with-modsecurity/(Also covered in my 2nd webcast last week: https://www.youtube.com/watch?v=OBVwdqEFmX0)
> 
> I have also covered this in my 2nd ModSec / CRS webcast last week (plus some
> additional interesting stuff):
> https://www.youtube.com/watch?v=OBVwdqEFmX0
> 
> Best,
> 
> Christian
> 
> 
> -- 
> Ultimately, motivation gets us started, 
> but discipline and habit are what enable us to finish.
> -- Matthew Helmke
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] ModSec / CRS: Use of GeoIP & ASN information

[Christian F. <chr...@ne...>]

Hey Joel,

On Wed, Oct 19, 2022 at 11:50:45AM +1030, Joel Williams wrote:
> Thanks Christian! I enjoyed the article.

Thank you very much. One gets very little feedback for technical blog posts.
So this is very much appreciated.

> I agree that ASN is underrated - I get a lot of scans from well-known and
> generally reputable cloud providers which operate in multiple countries, and
> blocking these providers seems like a much safer way to avoid false
> positives than doing it by country. However there is still a risk that
> people are using personal VPSes to run proxies or have good reasons to use
> services like Tor. While this is probably not a very significant proportion
> of people I’m reluctant to block access to customer sites outright with no
> recourse for these users. On the other hand, blocking access by these ASNs
> to specific resources like the WordPress wp-login.php page would probably be
> OK.

I do not block by ASN and I do not recommend doing it. Yet I skip some of
them when doing false positive analysis. Meaning, it's OK to use DigitalOcean
as your personal VPN provider, but when you hit a false positive on my
website, chances are I won't react to it without a call.

Maybe I'll follow up with a blog post on mean anomaly scores per ASN on
the netnea website. It's staggering how 2-3 ASNs are really topping.

Mean incoming anomaly score across the entire log: 0.13
US ASN 53667: PONYNET: Mean anomaly score of 3!

What is also interesting - but bumps into the same TOR / VPN problem - is to
check User-Agents against ASNs. So you're pretending to be a Mozilla
(=any Browser), yet you live on a server ASN ...

> One idea I’m toying with is creating an interstitial page similar to
> Cloudflare’s “Checking your browser..” page. For ASNs which are problematic
> it would be a bit safer to force someone to perform a hCaptcha or something
> check before they can get through to the intended site and set a cookie. I
> think this might be possible but a little bit difficult to create entirely
> using mod_security though, so I’m thinking about writing a new (and
> relatively simple) Apache module. I’d love to hear if someone has already
> done this!

Ah, the sweet promises of anti-automation. :)

I'm sure this has been done, but I have not seen a public description how
to pull it off with open source tools. Yet I do not think it would be
very complicated with ModSec.

Pseudo-Code:
* ModSec Rule: if suspicious ASN and no cookie: redirect to Captcha
* Captcha Page: if successful captcha: set cookie

Suspicious ASNs in separate file (-> @pmFromFile).

I guess that's all.

Now that I think about it, it sounds as if it would make for a lovely blog 
post.

This presentation here as more ideas that could be harvested and implemented
in ModSecurity: https://www.youtube.com/watch?v=XKkyvO2rQ-E
(Don't let the title fool you, a lot of it is about anti-automation. And
it's a great talk btw)
All together this could make an interesting anti-automation CRS plugin.

Best!

Christian









> 
> Joel
> 
> > On 19 Oct 2022, at 12:04 am, Christian Folini
> > <chr...@ne...> wrote:
> > 
> > Hi there,
> > 
> > During the years, I have found the use of GeoIP (& ASN) information in
> > #ModSecurity / @CoreRuleSet very useful. Yet very few people do this for
> > GeoIP and practically nobody for ASN. 
> > 
> > It really helps to weed out false positives or defend in case of certain
> > persistent attacks.
> > 
> > Since good documentation on the subject is scare, here is how to get this
> > into your setup:
> > 
> > https://www.netnea.com/cms/2022/10/12/using-geoip-information-together-with-modsecurity/(Also
> > covered in my 2nd webcast last week:
> > https://www.youtube.com/watch?v=OBVwdqEFmX0)
> > 
> > I have also covered this in my 2nd ModSec / CRS webcast last week (plus
> > some additional interesting stuff):
> > https://www.youtube.com/watch?v=OBVwdqEFmX0
> > 
> > Best,
> > 
> > Christian
> > 
> > 
> > -- Ultimately, motivation gets us started, but discipline and habit are
> > what enable us to finish.  -- Matthew Helmke
> > 
> > 
> > _______________________________________________ mod-security-users mailing
> > list mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial
> > ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> 
> _______________________________________________ mod-security-users mailing
> list mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users Commercial
> ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] ModSec / CRS: Use of GeoIP & ASN information

[<az...@po...>]

Hi!

> One idea I’m toying with is creating an interstitial page similar to  
> Cloudflare’s “Checking your browser..” page. For ASNs which are  
> problematic it would be a bit safer to force someone to perform a  
> hCaptcha or something check before they can get through to the  
> intended site and set a cookie. I think this might be possible but a  
> little bit difficult to create entirely using mod_security though,  
> so I’m thinking about writing a new (and relatively simple) Apache  
> module. I’d love to hear if someone has already done this!


My ModSecurity reCAPTCHA library may help you with this, check it out  
(needs Lua support in ModSec):
https://github.com/azurit/modsecurity-recaptcha


azurit



>
> Joel
>
>> On 19 Oct 2022, at 12:04 am, Christian Folini  
>> <chr...@ne...> wrote:
>>
>> Hi there,
>>
>> During the years, I have found the use of GeoIP (& ASN) information in
>> #ModSecurity / @CoreRuleSet very useful. Yet very few people do
>> this for GeoIP and practically nobody for ASN.
>>
>> It really helps to weed out false positives or defend in case of certain
>> persistent attacks.
>>
>> Since good documentation on the subject is scare, here is how to get this
>> into your setup:
>>
>> https://www.netnea.com/cms/2022/10/12/using-geoip-information-together-with-modsecurity/(Also covered in my 2nd webcast last week:  
>> https://www.youtube.com/watch?v=OBVwdqEFmX0)
>>
>> I have also covered this in my 2nd ModSec / CRS webcast last week (plus some
>> additional interesting stuff):
>> https://www.youtube.com/watch?v=OBVwdqEFmX0
>>
>> Best,
>>
>> Christian
>>
>>
>> --
>> Ultimately, motivation gets us started,
>> but discipline and habit are what enable us to finish.
>> -- Matthew Helmke
>>
>>
>> _______________________________________________
>> mod-security-users mailing list
>> mod...@li...
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/

Re: [mod-security-users] ModSec / CRS: Use of GeoIP & ASN information

[Christian F. <chr...@ne...>]

Ah, sweet. Had forgotten about this.

Thanks azurit!


On Thu, Oct 20, 2022 at 03:27:22PM +0200, az...@po... wrote:
> Hi!
> 
> > One idea I’m toying with is creating an interstitial page similar to
> > Cloudflare’s “Checking your browser..” page. For ASNs which are
> > problematic it would be a bit safer to force someone to perform a
> > hCaptcha or something check before they can get through to the intended
> > site and set a cookie. I think this might be possible but a little bit
> > difficult to create entirely using mod_security though, so I’m thinking
> > about writing a new (and relatively simple) Apache module. I’d love to
> > hear if someone has already done this!
> 
> 
> My ModSecurity reCAPTCHA library may help you with this, check it out (needs
> Lua support in ModSec):
> https://github.com/azurit/modsecurity-recaptcha
> 
> 
> azurit
> 
> 
> 
> > 
> > Joel
> > 
> > > On 19 Oct 2022, at 12:04 am, Christian Folini
> > > <chr...@ne...> wrote:
> > > 
> > > Hi there,
> > > 
> > > During the years, I have found the use of GeoIP (& ASN) information in
> > > #ModSecurity / @CoreRuleSet very useful. Yet very few people do
> > > this for GeoIP and practically nobody for ASN.
> > > 
> > > It really helps to weed out false positives or defend in case of certain
> > > persistent attacks.
> > > 
> > > Since good documentation on the subject is scare, here is how to get this
> > > into your setup:
> > > 
> > > https://www.netnea.com/cms/2022/10/12/using-geoip-information-together-with-modsecurity/(Also
> > > covered in my 2nd webcast last week:
> > > https://www.youtube.com/watch?v=OBVwdqEFmX0)
> > > 
> > > I have also covered this in my 2nd ModSec / CRS webcast last week (plus some
> > > additional interesting stuff):
> > > https://www.youtube.com/watch?v=OBVwdqEFmX0
> > > 
> > > Best,
> > > 
> > > Christian
> > > 
> > > 
> > > --
> > > Ultimately, motivation gets us started,
> > > but discipline and habit are what enable us to finish.
> > > -- Matthew Helmke
> > > 
> > > 
> > > _______________________________________________
> > > mod-security-users mailing list
> > > mod...@li...
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > 
> > 
> > 
> > _______________________________________________
> > mod-security-users mailing list
> > mod...@li...
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
> 
> 
> 
> 
> 
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/