Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since it is possible to fake the source-ip of an ip-package, is it also possible to anonymize DDOS-attacks?

share|improve this question
    
Nope. A layer 7 DOS is gonna get bottle-necked by whatever proxy you use to spoof your IP. Layer 4 is still OK though... – KnightOfNi Jan 28 '14 at 2:41
    
There's a really good defcon video about this somewhere on youtube... it doesn't go into really specific stuff, but it answers your question. Unfortunately, I lost the link, but if you search for "DEFCON DOS" you're probably going to find it. – KnightOfNi Jan 28 '14 at 2:51
    
Have a Google for DNS amplification – symcbean Feb 11 '14 at 22:48

The other answers seemed wrong to me, so here is my attempt.

Yes.

This is very common, and has recently seem attacks in the rage of hundreds of gigabits per second. The idea is not to spoof your IP to the target machine, but to spoof your IP to an intermediary that returns data back to your spoofed IP (target).

It is generally not very easy to spoof source IP addresses, so having a direct distributed DOS against a target (i.e: SYN Flood) using all fake addresses would be very difficult. If you are able to spoof a few addresses, you would have the best luck abusing a service that would result in an amplification (DNS, NTP). So the purpose of spoofing the address here is not to hide your IP, but to make the intermediate think you are the victim, flooding them with unsolicited responses.

The attack would go something like this:

  • The attacker spoofs the victims IP address, and sends a 60 Byte DNS request to an open resolver.
  • The resolver responds to the victim's IP, a 4000 byte TXT record

Here is some more info on recent attacks:

https://www.watchguard.com/infocenter/editorial/41649.asp

http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack

share|improve this answer

A DDoS attack is usually just a shitload of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc...

But, knowing that a DDoS is distributed, you'd need to feed many machines the possibility to spoof addresses. If you want to bring a target to its knees, it may be more useful to send a heavy HTTP GET request (a search query, for example), rather than just a TCP SYN packet. For this, spoofing will be a challenge; since you won't be able to complete the TCP 3-way handshake.

share|improve this answer

The first D in DDOS means distributed.
All the attractiveness of distributed DOS is that it comes from so many actors that your are unable to correctly identifies the responsible.
Why would you bother with spoofing an IP.
Also most of the DDOS these days are run by botnets and those attacks are made againt the will of infected victims.
Spoofing an IP is nothing relevant in this case.

share|improve this answer

You could send a request to a large list of websites. If you spoofed your IP address as the target IP address, then all of the websites' responses would go to the target IP address, potentially creating a DDoS. It would be distributed, because lots of servers are all sending the response.

share|improve this answer
2  
Well, HTTP requests are done over TCP, which means you need to complete a handshake before getting HTTP responses. The TCP ACK response isn't very efficient for DDoS. – Benoit Esnard Jan 17 at 15:46
    
reflection is also covered by David Houde's answer – schroeder Jan 17 at 16:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.