I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try to bring the services down and access the fake services. These ports adopt a blocking process of a connection request and record the IP and port of the client. These are logged and aren't granted access on service on port 80. But what to do if the client spoofs his IP? How can I modify my system?
I'm just going to answer (very) generally and let you do the math.
IP address spoofing works just like any other form of spoofing. Spoofing means pretending to be someone who you aren't. In the context of information security, IP address spoofing (henceforth refereed to simply as "spoofing") is quite common in many attacks. For example to target systems which utilize IP address as a security control such as router access control lists, firewalls, trust relationships, etc. Additionally it's very typically used in denial of service attacks. IP spoofing in practice can vary from mundane to highly complex. In general there are really 3 common ways to do it.
You could simply just set your IP address to anything you want using
I was actually going to go on, but I'm not really good at this and I'm tired so I'm just gonna close up.. with a few words. Maybe I will come back and finish this up at a later time. Sorry.
The easiest way that I know of to do spoofing is via source routing. Just use loose source routing, put yourself in the path and you're good to go. The only dependency is that at least one network path between you and your target supports source routing. I don't think this is really much of an issue at this time.
Now to defend against spoofing what do you need to do? Keep your TCP/IP stack patched. Don't extend trust relationships outside of firewalls unless it's over an encrypted tunnel. Don't use IP addresses for authentication (yes, people do actually do this.) Use anti-spoof filters on routers and firewalls, either direct anti-spoof or reverse path forwarding checks. Don't allow source routed packets through network gateways and especially not internet gateways. (Some networking guys seem to have a hard-on for source routing on the internal network, but it's always worth a shot) In IOS this is as easy as changing one setting. It's called "no ip source-route". Additionally anti-spoof filters can be set to generate logs and you could use some fancy machine learning techniques to detect non expected source addresses on a given network.
Sorry to cut it short, but I'm out. Cherrio.
|show 2 more comments|
If the user spoofs his IP, he can't get a reply from your system, so that's not a vector to worry about. Spoofed IP's (if they even succeed) will only be a problem in terms of DoS attacks, not access.