topic Re: Daily Shodan scan? in Advanced Threat Prevention Discussions

Daily Shodan scan?

SethArnoff — Thu, 01 Feb 2018 14:55:23 GMT

Hello all,

We just recently made the Shodan wall of fame and I'm now getting their scan showing up every day in my Threat log. Our action is set to reset. What do you typically do in this case? Should I ignore this and accept I will be seeing this scan every day from now on?

Threat Name

Gh0st.Gen Command and Control Traffic

Attacker

66.240.205.34

Re: Daily Shodan scan?

bvandivier — Thu, 01 Feb 2018 16:30:34 GMT

One suggestion would be to implement Zone Protection and/or DoS Protection to block reconnaissance activity of this nature if you have not already done so.

https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Understanding-DoS-Protection/ta-p/54562?attachment-id=1085

Otherwise, you could implement the use of EDLs in conjunction with an automated feed from somewhere such as Minemeld to dynamically block Shodan activity.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

https://live.paloaltonetworks.com/t5/MineMeld-Articles/Connecting-PAN-OS-to-MineMeld-using-External-Dynamic-Lists/ta-p/190414

https://live.paloaltonetworks.com/t5/MineMeld/ct-p/MineMeld

Re: Daily Shodan scan?

SethArnoff — Thu, 01 Feb 2018 16:46:54 GMT

Thank you! The Zone Protection was what I was looking for.

Question on EDL: I have it setup to block Outgoing IP's, but this Shodan scan is Incoming. I'm assuming I can set an EDL to also block Incoming connections by setting the EDL in the Source Address as opposed to Destination?

Re: Daily Shodan scan?

bvandivier — Thu, 01 Feb 2018 16:57:42 GMT

External Dynamic Lists can be used in security policies regardless of directionality. Behavior will vary depending on the type of list. In your case you can specify and IP-based EDLs within the source column of a security policy rule.

Re: Daily Shodan scan?

SethArnoff — Thu, 01 Feb 2018 17:25:30 GMT

Thank you again!

Re: Daily Shodan scan?

bvandivier — Thu, 01 Feb 2018 17:26:53 GMT

You are very welcome. It was my pleasure.