Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've noticed that there's a number of questions where relying on source IP address as a control gets mentioned and in most gets dismissed as being unreliable.

I'd be interested in hearing from anyone detail on where they think using source IP address as a control is a potentially useful idea or a bad idea and why.

One thing I've noticed is that the idea of "spoofing" the source IP address gets brought up but people rarely go into detail about how challenging that might be in practice (eg, accurately guessing TCP sequence numbers), so I'd be interested in any opinions about the practicality of spoofing IP addresses with common application protocol such as HTTP.

share|improve this question
1  
Simply relying on IP adress is probably not a good thing, but it may very well be used as part of a security scheme (possibly together with port knocking for otherwise secured admin access or such). It makes sense to only allow certain IP's if you have a static server (pool) talking to your server. Protecting the network itself may also make sense. But there are too many if's to rely on it on its own, as the other posters pointed out. –  Maarten Bodewes - owlstead Jun 13 '11 at 2:14

2 Answers 2

up vote 4 down vote accepted

Using IP-based authentication may be reasonable if security doesn't matter much. Otherwise, it is a pretty dubious practice. It provides weak security, at best.

In some settings, IP hijacking is quite easy. For instance, the typical case where people use IP-based authentication is to allow access from some other machine or machines from the same corporate local network. But if you have any open wireless network (or WEP wireless network) within that IP address space, then it's trivial to gain access, to hijack connections by other machines, etc.

For web-based systems protected by IP hijacking, open proxies are also a threat.

Another threat is the risk of compromised machines being connected to the internal network.

Bottom line: I would not recommend use of IP-based authentication, unless the consequences of unauthorized access are quite modest (and perhaps not even then).

share|improve this answer
    
Could you explain how is that supposed to be trivial at all? Open proxies doesn't simply let me spoof any address.. but only their own right? –  Pacerier Oct 1 '11 at 23:06
    
@Pacerier, yes, open proxies only let you use their address -- but that may be enough to compromise security. –  D.W. Oct 2 '11 at 2:46

One thing I've noticed is that the idea of "spoofing" the source IP address gets brought up but people rarely go into detail about how challenging that might be in practice (eg, accurately guessing TCP sequence numbers), so I'd be interested in any opinions about the practicality of spoofing IP addresses with common application protocol such as HTTP.

A fair point which earns my +1.

If you're after hijacking an existing connection given you know for arguments' sake that 256.0.0.1 (deliberately not real) is on the whitelist is fairly tough, as you state.

I think we reach for IP spoofing as the most obvious threat, like with the idea that all hackers are "leet", use tiling window managers and have transparent terminals. However, there are some more obvious problems:

  1. What happens if another computer acquires that IP address? If you use IP address based restrictions alone, then it becomes a problem.
  2. What happens if that computer becomes compromised? Again, a problem if you use IP address filtering alone.
  3. What happens when you have NAT and no access to the source IP address?

In other words, the problem is that whilst this might restrict access, it does nothing to check authorisation. Like a stateless firewall, which assumes everyone on this private subnet is good. That's all very well, but did you authorise their access? If they can acquire, by any means, an IP address in the right range, you're going to hand them trust.

By contrast, if you use some form of authentication layer, you make it harder for the would be attacker to gain access where they are not authorised.

A better solution in my mind is to use the likes of IPtables to mark certain interfaces as having access to more or fewer services. This is then tied to the physical network, which is much harder for an external (or even internal) attacker to manipulate. You still, however, need authentication on top of that.

share|improve this answer
1  
I think you didn't actually state how a leet hacker with a transparent terminal could spoof an IP address.. –  Pacerier Oct 1 '11 at 23:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.