• Activity
  • Votes
  • Comments
  • New
  • All activity
    • Showing only topics in ~comp with the tag "firewall". Back to normal view / Search all groups

    2. How reliable is IP ownership information?

      Ask
      I have interactive firewalls like OpenSnitch running on most of my desktop OS's. I like to see what is going on with my machines' network connections to learn about networking, infosec, and to...

      I have interactive firewalls like OpenSnitch running on most of my desktop OS's. I like to see what is going on with my machines' network connections to learn about networking, infosec, and to have have some peace of mind.

      Example workflow:

      1. Get a firewall notification of a new incoming connection to some process running on my machine
      2. If no DNS entry exists and only the IP address is provided, then I google the IP
      3. I find something like https://ipinfo.io/74.125.20.189
      4. I make a decision as to whether allow/deny based on the ownership info which I found in step 3.

      Aside from trusting the particular site presenting the ownership info, how reliable is this information regarding IP ownership?

      For example, if an IP came back as "Google" could it really be a GCP instance running a command and control server?

      Another example, I know that large corps own big blocks of IPv4, but they must lease these IP's out to whomever, right? I imagine there is some wild-west market for these with little accountability?

      Are either of these scenarios realistic? If so, is my entire workflow for "do I trust this IP" pointless?

      edit: btw, I used to catch and deny incoming connections from *.ru to the Windows legacy Skype client all the time. I cannot think of any non-evil reason why that should have been happening. That particular series of events is what really validated me doing this. If you can think of a non-evil reason for any incoming connections to skype from *.ru, please let me know.
      5 votes