Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and from that moment on allow any computer in a certain IP-range certain light-weight editing access to a website. Plus we want to be able to configure this beforehand on the server.

  • I understand it is possible and easy to spoof an IP address
  • A spoofed IP address cannot receive an answer from your server
  • When behind a proxy or router, is there a related way that allows me to identify the user, i.e. some Forwarded-By (or what's it called) header?

I'm particularly interested by the second item. According to Wikipedia, it is very hard but not impossible to catch the answer packet of a spoofed IP address. It doesn't specify what's needed though.

What would you recommend provided the requirement is to be able to configure this IP-based (or related)?

share|improve this question
What books exactly? – Ramhound Mar 29 '12 at 19:09
@Ramhound: I'm not sure which, but I encountered it in several of them. Probably some Apache security book, my PKI book etc, but it's a while ago, and I just know I read it several times somewhere (sorry, not a very substantive answer). – Abel Mar 29 '12 at 20:34

3 Answers

up vote 4 down vote accepted

No. This is probably going to be weak. Also, in certain cases IP spoofing is a lot easier than your question indicates. For instance, if the user is logging in over open Wifi connection, then it is easy to do a man-in-the-middle attack or spoof the user's IP address.

There is no Forwarded-By header added when a router forwards an IP packet. There is no such header that's going to help you detect IP spoofing.

See also In what scenarios is relying on source IP address as a security control acceptable/unacceptable?.

If you want one-time validation, I suggest that you set a secure persistent cookie on the user's browser (once you've authenticated them) so you can recognize them again in the future. That will eliminate the need for them to conduct another authentication step in the future, as long as they continue to use the same machine and browser.

share|improve this answer
It's kind of interesting that none of these answers (nor in the linked question) explain how a spoofed IP address can receive an answer from the server, other than the obvious man in the middle attack. Ramhound below even says it is 100% impossible. Of course, this is only one aspect of the problems with IP address authentication. – Abel Mar 29 '12 at 20:42
4  
@Abel, (1) Sometimes, the attacker does not need to receive an answer from the server. In those situations, one attack involves guessing the TCP Initial Sequence Number (this used to be easy; now it requires 2^32 trials, but that is disturbingly close to the realm of feasibility). (2) If the attacker does need to see the response, there are ways, such as BGP attacks. These are not the easiest or most common attacks, not by a long shot, but they are some ways that an attacker can receive an answer from the server. – D.W. Mar 30 '12 at 6:27
Excellent, that's a clear cut story. Apparently, BGP attacks can happen anywhere, anytime without someone noticing easily. The last line is troubling: "ISPs, he said, have been holding their breath, 'hoping that people don’t discover (this) and exploit it.'" – Abel Mar 30 '12 at 9:37
up vote 7 down vote

First of all, I need to emphasize that IP address can never be used to authenticate a user, it can only be used to (attempt to) validate a host. Even if IP address were perfectly tied to an exact computer on an exact network port, we'd still have no guarantee that a particular user was at the console of that computer at that time. So if you are trying to ensure that the resources you are protecting can only be accessed by a particular user, you need to be doing user-level authentication of some kind.

Now it may be that you only want to limit access to, say, people who work at a certain business, or who go to a certain school, or who live in certain house. So you believe that IP-only validation is worth the additional risk. Even then you can't guarantee your data is going to the right place.

A wireline example I can think of is this. Let's say I am a cable internet subscriber and I want to intercept my neighbor's IP traffic. Our cable provider uses DHCP to assign addresses to us from a pool of addresses set aside for dynamic IP addressing. Conceptually, I can intercept his address by discovering his IP address; discovering his MAC address; setting my MAC address to be a clone of his MAC address; rebooting his cable modem (e.g. by interrupting power or cable to his house); issuing a DHCP request.

Since many DHCP servers usually try to assign MACs the same IP they had previously, the cable provider will assign your IP to me. Now this won't work forever - the cable provider will eventually see an IP address collision and investigate the issue. But by that time I may have already stolen your data.

share|improve this answer
The actual scenario, I should've said, is to limit access by IP addresses on the LAN or on the VPN network. However, word has it, that the client would like access from some people's homes as well. It should be said that the application is hosted under another app that does require authentication, but then it just uses unsecure HTTP requests. All it then takes is picking up the URL (plus the IP spoofing/hijacking) to gain access. At least that's what I think. – Abel Mar 29 '12 at 20:47
up vote 0 down vote

A spoofed IP address cannot receive an answer from your server

This is 100% true. The response to a TCP could not be sent if the ip address is not actually the valid ip address.

When behind a proxy or router, is there a related way that allows me to identify the user, i.e. some Forwarded-By (or what's it called) header?

I don't understand the purpose of this question. If you are behind a router then the user's ip address is what said hardware has assigned it to. So any identity information would be that information and not the actual information anyone else would see outside of your network.

What would you recommend provided the requirement is to be able to configure this IP-based (or related)?

What exactly is the requirement?

I'm particularly interested by the second item. According to Wikipedia, it is very hard but not impossible to catch the answer packet of a spoofed IP address. It doesn't specify what's needed though.

This would require you be between the server and the client. Otherwise all responses are actually going to the ip address the server thinks it should go to, and since you don't actually have that ip address, you won't recieve that ip address. By being in the middle you recieve the packet ( actually all packets that is another matter all together ) and are able to respond to said packet.

Otherwise eventually the server will like any tcp connection forget about you.

Once every single electronic device that is connected to the internet has a IPv6 address you MIGHT be able to use an ip address to verify a "device" but pointed out never the "user" itself. This of course is unlikely to ever happen for many reasons. IPv4 has been around for 20-30 years, which means, there are still more IPv6 addresss, then devices made in that time though :$

share|improve this answer
On the Wikipedia article on IP spoofing it is mentioned that with some effort, it is possible to redirect a response back to a spoofed address. It might be that they mean through a man in the middle or another form of hijacking, but I didn't get that impression. Are you positive on the 100% figure? – Abel Mar 29 '12 at 20:49
1  
if you are spoofing IP on the same network and able to sniff the responses from the server it is trivial to spoof a connection and get a response from the server simply by listening for traffic destined to the spoofed IP – Mark S. Mar 30 '12 at 2:15
@MarkScrano: I was thinking of the Internet WAN, actually, and that's not so trivial, but user B.W. answered this can be done with BGP attacks for one. But in either case, "100%" in this answer is too strong a number. – Abel Mar 30 '12 at 9:40
how do you know your network is safer than the internet? Are you sure nobody can get a real ip in your network? If any machine in your network is compromised, you can't. And you can't make sure no device in your network can't be/isn't compromised. – ymajoros May 26 at 10:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.