Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Since it is possible to fake the source-ip of an ip-package, is it also possible to anonymize DDOS-attacks?

share|improve this question
    
Nope. A layer 7 DOS is gonna get bottle-necked by whatever proxy you use to spoof your IP. Layer 4 is still OK though... –  KnightOfNi Jan 28 at 2:41
    
There's a really good defcon video about this somewhere on youtube... it doesn't go into really specific stuff, but it answers your question. Unfortunately, I lost the link, but if you search for "DEFCON DOS" you're probably going to find it. –  KnightOfNi Jan 28 at 2:51
    
Have a Google for DNS amplification –  symcbean Feb 11 at 22:48

3 Answers 3

A DDoS attack is usually just a shitload of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc...

But, knowing that a DDoS is distributed, you'd need to feed many machines the possibility to spoof addresses. If you want to bring a target to its knees, it may be more useful to send a heavy HTTP GET request (a search query, for example), rather than just a TCP SYN packet. For this, spoofing will be a challenge; since you won't be able to complete the TCP 3-way handshake.

share|improve this answer

The first D in DDOS means distributed.
All the attractiveness of distributed DOS is that it comes from so many actors that your are unable to correctly identifies the responsible.
Why would you bother with spoofing an IP.
Also most of the DDOS these days are run by botnets and those attacks are made againt the will of infected victims.
Spoofing an IP is nothing relevant in this case.

share|improve this answer

The other answers seemed wrong to me, so here is my attempt.

Yes.

This is very common, and has recently seem attacks in the rage of hundreds of gigabits per second. The idea is not to spoof your IP to the target machine, but to spoof your IP to an intermediary that returns data back to your spoofed IP (target).

It is generally not very easy to spoof source IP addresses, so having a direct distributed DOS against a target (i.e: SYN Flood) using all fake addresses would be very difficult. If you are able to spoof a few addresses, you would have the best luck abusing a service that would result in an amplification (DNS, NTP). So the purpose of spoofing the address here is not to hide your IP, but to make the intermediate think you are the victim, flooding them with unsolicited responses.

The attack would go something like this:

  • The attacker spoofs the victims IP address, and sends a 60 Byte DNS request to an open resolver.
  • The resolver responds to the victim's IP, a 4000 byte TXT record

Here is some more info on recent attacks:

https://www.watchguard.com/infocenter/editorial/41649.asp

http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.