News for hackers. Stuff that matters.

A comment on Apple apps on Big Sur bypass some firewalls and VPNs. Parent comment

Re:Apple apps on Big Sur bypass some firewalls and VPNs by enraged_camel on Monday November 16, 2020 @10:03AM (#25112454)
Just curious, how do they detect the fact that the connection is from a VPN? Are they subscribing to IP blacklists, or is there some other method?
[ Parent | on HN ]
Re:Apple apps on Big Sur bypass some firewalls and VPNs by penagwin on Monday November 16, 2020 @10:48AM (#25113086)
IP addresses are assigned in blocks, and these blocks are assigned to registered companies - Long story short you can roughly determine whether an IP address is from a datacenter or is "residential" without too much issue - All DigitalOcean droplets are given IP addresses within DO's range for example.

Basically if the IP is from a datacenter - it's likely a VPN.

[ Parent | on HN ]
Re:Apple apps on Big Sur bypass some firewalls and VPNs by crazygringo on Monday November 16, 2020 @10:10AM (#25112571)
Yes, it's IP blacklists AFAIK.

And for sites with a lot of traffic, you probably don't even need an external subscription, you can deduce the ranges yourself simply by checking for IP addresses that wind up having logged-in users from all over the world in a short time frame.

Pretty easy to do accurately with a short set of heuristics.

[ Parent | on HN ]
Re:Apple apps on Big Sur bypass some firewalls and VPNs by gcoleman on Monday November 16, 2020 @10:47AM (#25113074)
Many geo-ip services also offer VPN or server detection (e.g. is the IP in one of the EC2 ranges).

In a previous job at an online gambling company we found that a large percentage of fraudulent user accounts came from VPNs so ended up banning them at the geo lookup stage.

[ Parent | on HN ]
Re:Apple apps on Big Sur bypass some firewalls and VPNs by gjsman-1000 on Monday November 16, 2020 @10:11AM (#25112584)
Easy. How many users are logging in from the same IP address is a big clue.
[ Parent | on HN ]