IP spoofing, also known as IP address forgery or a host file hijack, is a hijacking technique in which a cracker masquerades as a trusted host to conceal his identity, spoof a Web site, hijack browsers, or gain access to a network.
69
votes
12answers
16k views
Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a ...
16
votes
3answers
503 views
Vulnerable code suggested on OWASP?
Session Hijacking Prevention
It is good practice to bind sessions to IP addresses, that would prevent most session hijacking scenarios (but not all), however some users might use anonymity ...
16
votes
2answers
432 views
In what scenarios is relying on source IP address as a security control acceptable/unacceptable?
I've noticed that there's a number of questions where relying on source IP address as a control gets mentioned and in most gets dismissed as being unreliable.
I'd be interested in hearing from anyone ...
15
votes
6answers
1k views
What security risks does IP spoofing bring?
By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
13
votes
6answers
2k views
How does a server obtain the IP Address of a user?
How does a server obtain the IP Address of a user? Is it possible to fool the server by spoofing the IP Address?
12
votes
6answers
1k views
What tools are available to identify which country a specific IP address is located in?
In trying to identify the country a user logs in from, or to block country ranges for whatever reason (for example regulatory requirements) what tools, whether online or offline, are available?
11
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
10
votes
3answers
447 views
Are there valid reasons for spoofing an address?
This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.
Are there valid reasons to spoof an address?
9
votes
5answers
574 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
7
votes
3answers
212 views
Verify a website user is behind corporate firewall?
We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
6
votes
4answers
569 views
How can a company reduce exposure to packet spoofing? What solution should exist, but doesn't?
I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network ...
6
votes
3answers
337 views
IP Address spoofing?
According to:
https://secure.wikimedia.org/wikipedia/en/wiki/IP_address_spoofing
"this technique is mainly used when the attacker does not care about the response or the attacker has some way of ...
6
votes
3answers
233 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
6
votes
2answers
2k views
How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?
Practically speaking, how easy difficult is it to spoof DNS?
What scenarios are more risky than others? For example:
A phishing email or twitter link that attracts users to click a hyperlink
A ...
6
votes
1answer
463 views
Spoofed IPv4 and IPv6 addresses over the internet
I have a few questions regarding IPv4 and IPv6 spoofing. Might as well just list them to be concise:
What's the usual routing policy for ISPs' routers in regards to spoofed source addresses? i.e. if ...
5
votes
1answer
160 views
Parabolic Denial Of Service — Would it work?
Would this DoS attack be effective:
Attacker determines target (10.0.0.1)
Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1
Servers reply to 10.0.0.1 with syn packets
...
5
votes
3answers
359 views
Solaris: IP Spoofing Across Ethernet Ports
Given a Solaris machine with two network interfaces corresponding to the separate ethernet ports in the back.
0: 192.168.0.5/255.255.255.0
1: 192.168.1.5/255.255.255.0
with /etc/defaultrouter set ...
5
votes
4answers
860 views
Why don't ISPs filter on source address to prevent spoofing?
I'm under the impression that if all the ISP's were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably.
Are any ISPs implementing this ...
5
votes
2answers
554 views
Why would the browser present the certificate for an unknown outside site?
The first time each day that I attempt click on the 'Mail' link from the Yahoo home page, my browser (Seamonkey) throws up a dialog with the title 'Secure connection failed'.
The content in the ...
5
votes
2answers
863 views
Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?
I have read the TCP Connection Establishment on Wikipedia
In brief the packets to start are
SYN, with a (hopefully) random sequence number A from the client.
SYN-ACK, responding, with A+1 and ...
5
votes
1answer
271 views
Ingress RFC1918 spoofing: How to handle it?
I've seen packets originating from RFC1918 addresses from two fairly large european ISP's (ASN1257 & smaller ASN35706) coming in on eBGP transit links lately, and I'm a bit puzzled why it wouldn't ...
4
votes
3answers
2k views
How can I trace the IP address of person in chat?
Is it possible to trace my IP address when I am chatting with others (with gtalk or Facebook)? If so, how could someone do that?
4
votes
5answers
1k views
Is it trivial to bypass IP blocking?
There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked.
I've heard about IP spoofing and similar attacks. ...
4
votes
2answers
5k views
Does chatting over Skype expose my IP address?
Is there a way to identify a person's IP address in Skype, when you're chatting with them? Does this depend on their Skype settings? And if you've recorded chat messages, can they lead to the actual ...
4
votes
5answers
279 views
Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative ...
4
votes
1answer
414 views
172.16.33.197, 127.0.0.1 IP addresses in visitor logs
I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
4
votes
1answer
408 views
Brute force login attempt from spoofed IP's
I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
4
votes
3answers
2k views
Can I trust the source IP of an HTTP request?
As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
3
votes
3answers
800 views
How secure can IP based login be?
From several security books and sites I understand that IP-based security (with which I mean: user is verified only by IP address) is a bad idea. Our idea is not new: we want a one-time validation and ...
3
votes
4answers
306 views
How can an internet contest verify unique votes with only an email as an input parameter?
For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've ...
3
votes
5answers
275 views
Preventing online voter fraud
As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how ...
3
votes
5answers
1k views
GET request with different IPs
I need to check vulnerability in my polling system. So I need to send GET requests but every time with different IPs. Can anyone suggest something?
3
votes
2answers
54 views
What information should I provide to a website or organization when notifying them that their domain may be sending out spam?
Over the past few days, I've received several spam emails coming from the addresses of a school district. I don't know much about email message headers, but since they contain numerous references like ...
3
votes
1answer
40 views
Side Channel Attack Query
People Generally spoof their IP address by using any other device's ip address such as printer, scanner. My question is in this kind of particular attack why we are using these devices rather than ...
3
votes
2answers
232 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
3
votes
1answer
260 views
What kind of nefarious deeds can IP address Spoofing be used for? [duplicate]
Possible Duplicate:
What security risks does IP spoofing bring?
I found this article, which seems pretty good but was written in 2003 so I'm not sure how up to date it is.
Can IP address ...
2
votes
3answers
455 views
How can I make it more difficult for a user to create multiple accounts?
I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts.
What all of a user can be traced? I'm thinking:
IP address
Mac address
...
2
votes
2answers
449 views
Reveal the True IP of a User
Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection?
I.e.: To be able to uncover the true IP from transparent as well as ...
2
votes
3answers
102 views
Is it possible to pass TCP handshake with spoofed IP address?
Little time ago, me and my friends argued if TCP handshake can be passed with a spoofed IP address.
Assume I have a https web server that allows only admin's IP numbers.
Can anyone connect that web ...
2
votes
1answer
1k views
Spoofing email From address
Providing all legal measures are taken care of, what are some of the ways someone can spoof an email "From" field address and actually get the email to the recipient without spam filters getting in ...
2
votes
2answers
114 views
Does “loose source and record route” drop the source address?
Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur?
It ...
2
votes
1answer
591 views
Stopping Session Hijacking
If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
2
votes
4answers
1k views
Stopping users from spoofing an IP
I have a MikroTik router (that has firewall and scripting capabilities) that is acting as a DHCP server for the 192.168.1.0/24 subnet. Is there any way I can stop it from passing traffic from a user ...
2
votes
1answer
246 views
IP Conflicts / Spoofing
Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ?
Can TCP stack 'shutdown' or stop in order to protect itself ?
1
vote
4answers
4k views
Netcat IP Spoofing
I am connecting to a server
nc -v 192.168.0.1 1111
But I want to do IP spoofing because the server on 192.168.0.1 only accepting commands from 7.7.7.7. We are two friends, I am 192.168.1.1, and my ...
1
vote
2answers
290 views
Is SSH2 still vulnerable to man-in-middle attacks?
With SSH using RSA public key authentication, can an attacker spoof the server IP address and connect with client to obtain client password?
1
vote
2answers
130 views
IP attack by reading/writing data?
If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection).
Are there any further/more dangerous ...
1
vote
2answers
231 views
Why wireshark source ip tab lists other ip as well
I was trying to capture some packets using Wireshark. I could find a lots of ip in the source address tab. Which ip do they represent. Which all packets are visible to wireshark when I run it in my ...
1
vote
2answers
839 views
Tracing an IP from a mobile broadband ISP
My honeypot caught a hack attempt from an IP that was issued by Three Mobile Broadband (UK).
My immediate thought was that most probable explanation was that the user was in the UK and had his ...
1
vote
1answer
89 views
Do WPA-Enterprise implementations have built-in anti-IP-spoofing?
i'd like to know if WPA-Enterprise implementations have built-in anti-IP-spoofing. here's what i mean:
it seems to me like IP spoofing should be easily detectable and handled under WPA-Enterprise. ...
