17

Every now and then someone posts some strange log entries and asks what is going on. Sometimes these contains IP adresses of the presumed attackers.

It that OK? Or should they be edited out and anonymised? On one hand, I can imagine knowing the IP could be useful when answering sometimes, but on the other hand it might have privacy implications to leave them there. What is the correct response?

I raise the question because of a suggested edit to this question, that I did not know how to handle.

  • 1
    I think they should be edited(at least part of the IP) because what'S the good chance it's actually the OP's IP, and they don't even know.... They try to get help, but end up causing more issues... The issue is... Edits can usually be seen, so what's the point then, unless the edit button is locked in queue (like it is now), thus no one else can see edits... – XaolingBao Jun 9 '16 at 16:42
  • 1
    How could IP addresses be useful when answering? Unless they are already blacklisted, there's not much we can say or do by knowing the IP address of a presumed attacker (keeping in mind that a lot of attacks come from botnets and so on). – A. Darwin Jun 10 '16 at 13:24
  • @A.Darwin You may very well be right there. Maybe for geolocation? I honestly don't know. If you think they should be deleted, feel free to write an answer saying that. – Anders Jun 10 '16 at 13:28
  • I think this is on topic on the main site with a less narrow field of answers (i.e. Should I not publish I.P. addresses of presumed attackers anywhere?) – EKons Jun 15 '16 at 14:54
12

It is a fairly touchy question as both options have their good and bad sides.

I have seen a good 25-35% of IP related questions that get resolved much more easily when it is shown as is.

Askers often make mistakes in the way they present the IP to hide it, or they hide part of the problem by hiding the IP.

Add to that the possibility of getting a thorough investigation by someone that knows how to dig a little deeper.

On the other hand, specifying an IP address in reference to something that happened should at the very least avoid accusing the mentioned IP address as that could be viewed as defamation.

  • 2
    I agree, previously working in a support team I had to handle some people asking for help and showing "anonymized" logs where IPs, hostnames, usernames and file path were hidden... time to get the crystal ball out of the drawer ;) ! An IP can tell a lot of things, like someone being "attacked" by an IP actually belonging to Google or Microsoft Update services, or tell whether the "remote" host is not actually on the LAN, etc. – WhiteWinterWolf Jun 14 '16 at 21:47
  • 1
    @WhiteWinterWolf Mhm... aren't the first three octects enough to tell if the IP belongs to Google/Microsoft/AV vendor/etc. ? – A. Darwin Jun 15 '16 at 9:53
  • @A.Darwin: Fair enough, I agree with you. Taking the link posted by the OP as example I find the IPs with only the first two bytes shown readable (assuming that the last part is the same each time and that anonymization is cleanly done as in this example). Hiding the whole IP on the other side looses by far too much information (like: is the "x.x.x.x" we see at this line the same as the "x.x.x.x" we see there?). – WhiteWinterWolf Jun 15 '16 at 11:48
  • 1
    @A.Darwin It would be nice to simply vet any IP belonging to Google or Microsoft as good. Bad news: with Google Cloud and Microsoft Azure, it is possible for anyone (including malicious actors) to attack you from inside their IP address space. It's specially noticeable when they have special deals... – Ángel Jun 17 '16 at 22:36
9

In my opinion, we don't need to know the IP addresses, at least not in their complete form.

Maybe if those addresses are already blacklisted, and the OP doesn't know it, we could tell with some confidence that they are probably being used to carry out some attack, as opposed to be (for example) the addresses of normal users who entered the wrong password.

But usually, after the third or so login attempt, we can already say that an attack is going on. As far as DDoS attacks are concerned, they most likely use botnets, and if a regular user is caught in the crosshairs of an anti-DDoS IP ban, a successful DDoS defence may be well worth it. In all other situations (SQL injections, port scanning, etc.), the knowledge of the IP address is - in my opinion - useless for the purpose of an answer, and could only be useful if the OP decided to file a report to the police.

Another possible reason could be geolocation. Once in a while, questions arise on whether to block or not IP addresses based on geolocation. Sometimes this might be useful (e.g. to protect SSH servers from Chinese IP addresses, if it is only used by devices in the USA, without the need of a VPN, etc.), but sometimes it is not. In any case, the last octet is of no use, and in most cases the last two octets are irrelevant, since most country-level IP blocks are defined by the first two octets.

In the end, I think we should at least redact the last octet, and possibly the last two octets.

By the way, Lasagna pointed out that the edit history is visible. I don't think this is a serious issue, given that IP addresses are not meant to be secret, and that they cannot be easily tied to an individual. Even if that was a problem, moderators can intervene and redact the history.

  • 2
    Where knowing the first one or two octets comes in handy is if we see 168.192, or 10, then we know we are dealing with a private sub-net, and then that can be extremely helpful in determining the answer. And yes, making sure 168.192,xxx.xxx and 168.192,yyy.yyy are used to denote two specific addresses are used consistently is important. – Mark Stewart Jun 16 '16 at 16:19
  • If you could only see the first two octets, how would you know if the connections are comming from a single amchine or a number of machines on the same CIDR? Are there cases where this matters? DoS/scraping comes to mind. IMHO we should leave them as is. If you connect somewhere you hand over your "public" source IP and have no control of wether it is published or not. Obscuring the IP is also unlikely to matter much with public honeypot logs and how easily enumerable IPv4 is – wireghoul Jun 22 '16 at 7:43
6

No, we should generally leave them as-is

Having the full IP address would allow other users to:

  • Get its reverse host
  • Look up the owner of that address
  • Check for its presence in blacklists
  • Verify if it appears on the logs of other users

And removing the IP address won't remove it from the edit history, anyway. For a proper hiding, it should have been performed by the OP before asking.

Generally, assuming that the logs are faithful, there shouldn't be much an issue that the attack logs get public.

However, if some addresses prove to not be from an attacker (whoops, there are IPs from several legitimate users there), I would support its hiding.

  • How do you determine which is which with only a small log snippet to look at? – wireghoul Jun 22 '16 at 7:39
2

An IP address is, by definition, not private. It's not personally identifiable information. An IP address alone means nothing, and can't be connected to an individual.

At best, you MIGHT be able to tie it to a company where the traffic is coming from.

IP addresses of attackers is often times very useful information. There's well known sites on the internet that host spambots, attack tools, etc. This can be very revealing to the nature of the attack or the attacker.

So in general, I think the advice is to keep the IP information in. If you can show that it's harmful, take it out.

2

Well, if it is a sophisticated attack, an attacker might be able to use Google to automatically scan forums including StackExchange for their IP(s), alerting them if they are discovered so they can use countermeasures.

  • I'm pretty sure sophisticated attackers would not Google bomb their own IP. – forest Dec 28 '17 at 10:10
1

If you are using a website, simply add a clause in your website's TOS or whatever saying something along the lines of "Your IP address might be shown publicly (without any private personal data you have provided) for the purposes of determining, identifying, and revealing security threats". Im not a lawyer or anything but in my opinion, that should get you off the hook for merely disclosing IP adresses. Just keep in mind that slander and defamation of character could still be issues. So just be careful not to portray any provided IP addresses as doing intentionally wrongful or illegal actions (except when it is blatantly obvious), and you will be just fine.

As for stack exchanges policy.... Ask a moderator.

  • 2
    I'm pretty sure the moderator would answer "ask on meta"... :-) – Anders Jun 15 '16 at 15:00
  • I wasnt neccessarily saying to ask a mod. I was merely saying that you should ask someone with a more official understanding of things. IMO, ip addresses would be okay to disclose, but there might be a stack exchange TOS clause telling you that it is not allowed. – The Great Duck Jun 15 '16 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .