Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try to bring the services down and access the fake services. These ports adopt a blocking process of a connection request and record the IP and port of the client. These are logged and aren't granted access on service on port 80. But what to do if the client spoofs his IP? How can I modify my system?

share|improve this question
    
Just to clarify, are you exposing the services on an internal network or on the Internet? –  Gurzo Jan 13 at 19:25
    
@Gurzo,the services will be there on the internet. –  user1369975 Jan 13 at 19:39
2  
Why would an attacker reach your non-main ports first? Your system depends on someone reaching non-critical services before the critical ones. That's a highly specific scenario. –  schroeder Jan 13 at 19:58
1  
Also, why are you considering logging the source port of the attacker? Those will be randomly assigned anyway and of little value as a means to identify blockable targets. –  schroeder Jan 13 at 19:59
    
Need more information. Specifically the ports and protocols being used. Securing TCP is different than securing UDP. etc. –  user2320464 Jan 14 at 1:15
show 1 more comment

2 Answers

I'm just going to answer (very) generally and let you do the math.

IP address spoofing works just like any other form of spoofing. Spoofing means pretending to be someone who you aren't. In the context of information security, IP address spoofing (henceforth refereed to simply as "spoofing") is quite common in many attacks. For example to target systems which utilize IP address as a security control such as router access control lists, firewalls, trust relationships, etc. Additionally it's very typically used in denial of service attacks. IP spoofing in practice can vary from mundane to highly complex. In general there are really 3 common ways to do it.

You could simply just set your IP address to anything you want using ifconfig in Unix or netsh in Windows. Additionally many tools come with built in spoofing capabilities such as decoys in Nmap or you can use various packet crafting tools such as Scapy. This is great and all, but anyone with basic networking knowledge will tell you that isn't going be really very useful in many cases. Sure spoofing datagram protocols like UDP or ICMP is trivial, but what about TCP? First of all most ISPs ignore the source address so sure you can start shooting out packets with any IP you like and they'll probably get delivered, but if you actually want to have any sort meaningful interaction (ie. pretty much anything other than DoS) you're out of luck because the response will obviously be send to whomever you happen to be spoofing. This is the nature of session-oriented protocols like TCP. The three-way handshake is going to spoil all of your fun. For example: You send your spoofed packets (SYN [A, ISNa]) over then that machine (B) which will respond (ACK [A, ISNa+X] SYN [B, ISNb]) to whomever you happen to be spoofing (A), but the only response machine B will get back from machine A is a reset (RST). Now if you're on the same LAN as the system you're spoofing, this works a little differently as you could just intercept the messages. To get around this little problem with TCP one could try to predict ISNs. For this reason initial sequence numbers (ISNs) in TCP are supposed to be hard to guess.

I was actually going to go on, but I'm not really good at this and I'm tired so I'm just gonna close up.. with a few words. Maybe I will come back and finish this up at a later time. Sorry.

The easiest way that I know of to do spoofing is via source routing. Just use loose source routing, put yourself in the path and you're good to go. The only dependency is that at least one network path between you and your target supports source routing. I don't think this is really much of an issue at this time.

Now to defend against spoofing what do you need to do? Keep your TCP/IP stack patched. Don't extend trust relationships outside of firewalls unless it's over an encrypted tunnel. Don't use IP addresses for authentication (yes, people do actually do this.) Use anti-spoof filters on routers and firewalls, either direct anti-spoof or reverse path forwarding checks. Don't allow source routed packets through network gateways and especially not internet gateways. (Some networking guys seem to have a hard-on for source routing on the internal network, but it's always worth a shot) In IOS this is as easy as changing one setting. It's called "no ip source-route". Additionally anti-spoof filters can be set to generate logs and you could use some fancy machine learning techniques to detect non expected source addresses on a given network.

Sorry to cut it short, but I'm out. Cherrio.

share|improve this answer
    
Cite your source for "IP address spoofing is quite common in many attacks..." Have you personally used loose source routing at any point? It is frequently blocked making it impossible to use as a reliable vector for attack. –  schroeder Jan 14 at 0:25
    
You seem upset, Jordan. –  Anonymous Jan 14 at 1:02
    
@Anonymous,got your point but what can a developer do to catch the culprit in case of ip spoofing?Means if the network administrators take no step,what can the developer do for protection against it?What steps will companies like Google take to track down the victi by this strategy? –  user1369975 Jan 14 at 15:18
    
@Anonymous I'm not upset. I'm correcting you while giving you a chance to fill-in any knowledge gaps that I might have. Fast and loose security advice hurts us all. –  schroeder Jan 14 at 15:54
    
@user1369975 the endpoint cannot do anything about a spoofed IP. The TCP/IP stack just wasn't designed for that level of integrity checking. –  schroeder Jan 14 at 15:55
show 2 more comments

If the user spoofs his IP, he can't get a reply from your system, so that's not a vector to worry about. Spoofed IP's (if they even succeed) will only be a problem in terms of DoS attacks, not access.

share|improve this answer
    
,I am developing this project as a college student.I am interesting to take something more challenging.Can you cite something for this purpose? –  user1369975 Feb 5 at 7:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.