Hot answers tagged ip-spoofing
42
My answer pokes at the original question. What makes you think that they don't get caught?
The CIA and DoD found Osama bin Laden.
Typical means include OSINT, TECHINT, and HUMINT. Forensics can be done on Tor. Secure deletion tools such as sdelete, BCWipe, and DBAN are not perfect. Encryption tools such as GPG and Truecrypt are not perfect.
Online ...
31
From some experience with law enforcement and forensics, I can say one of the biggest issues is that ISPs really don't want to have to track users. Once they get beyond a certain level of management they lose 'common carrier' status and become liable for an awful lot of what their customers may do.
Also, many countries do not want to pass on information to ...
25
One of the most important aspects of an attack like this is covering your tracks. There are lots of different ways to do this, as it depends on the technology. To address your specific questions:
When they DDoS: If the flood was coming from their own machines, then it would be fairly easy to track them. The problem lies in the fact that they aren't using ...
16
You are correct when you say an attacker spoofing IP may not receive traffic back, but they may not want to. They may want traffic sent to another IP address - possibly for denial of service attack on that IP.
Alternatively, there are attacks which just require the initial part of the handshake to take down your defences (you mentioned SYN flood)
Less of a ...
15
In addition to the answers that have already been given, another reason it is so hard to catch anonymous is because anonymous can be anyone, literally. I mean this in two ways. First, hackers can use a combination of malware, spyware, and bots to access and use/loop through other peoples computers anywhere in the world; thus, making any computer, ...
14
There are NUMEROUS ways for a hacker to cover their tracks..
Here is one very generalized example:
A hacker can compromise a third party machine and use it to do attacks on the hackers behalf. Because the system is compromised, the hacker can delete/modify logs. A hacker can also piggyback machines, such as, log into machine A, from machine A log into ...
11
Well I responded to some posts above that had incorrect information, but I figured I should just post my own response to better explain.
Anonymous is made up of basically 2 subgroups:
Skiddies (script kiddies) and newbies who have only the most basic security knowledge, and just sit in their IRC and basically be the pwns for the attack. These are the ...
11
Use whois: http://tools.whois.net/whoisbyip/
Or/and you can try IP address geolocation services, like:
http://www.ip2location.com/
http://www.digitalenvoy.com/
http://www.maxmind.com/app/ip_locate
http://www.ip2country.com/
http://www.hostip.info/
http://www.atelierweb.com/iploc/
http://www.ip2country.net/
http://www.quova.com/
11
When you send a request to the server, the server need to know where to answer, it's with your ip address. This is directly based on the TCP/IP protocol and in a lower slice than web servers.
For the reason why Firebug doesn't show your IP address, it's like when you receive mail (paper), you have your address written in front, and the sender in the back. ...
11
Set up a web server and send them a link to something on it. Once they click the link, their IP address will be logged in your web server's access logs.
You could also host an image on said web server and trick a user into loading it through a third party's website. Some social networking sites allow you to upload snippets of HTML including image tags.
...
10
Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001.
UPDATE
Cloudflare blog entry about DNS Amplification DDoS, and follow-up ...
9
One thing I've noticed is that the idea of "spoofing" the source IP address gets brought up but people rarely go into detail about how challenging that might be in practice (eg, accurately guessing TCP sequence numbers), so I'd be interested in any opinions about the practicality of spoofing IP addresses with common application protocol such as HTTP.
A ...
9
In general yes, there is ways of doing this, as a quick google search would've been able to tell you.
When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...
9
Full IP spoofing is hard for the commoners.
Everything in IP is made of packets. Each packet has a source address and a destination address. IP spoofing is about sending packets with a wrong source address. Sending such a packet is simple enough with a few lines of code (it tends to require local Administrator / root rights; on Linux, this is a matter of a ...
9
While I am sure there are, in fact, firewalls that may do that, I am not off-hand aware of any that operate this way. There are packet spoofing detection mechanisms, although they tend to act a little different.
Bogon Filters
A bogon is defined as bogus IP address. Specifically, it is the list of all IP addresses that have not been allocated by IANA, by a ...
9
This code allows an attacker who knows the victim's X-Forwarded-For: header and the victim's session ID to login as that user. If the victim doesn't have an X-Forwarded-For: header, the attacker can put the victim's IP address in his header and the code will use that value as his legitimate IP address instead of his actual IP address. This is the ...
8
Essentially it depends on the attacker and what resources they have available. Ordinary home-users or attackers who aren't very dedicated might be deterred by source IP address blocking, but more advanced/determined attackers have a number of ways to get round this.
The obvious one is to use one of the wide range of proxy services available on the ...
8
If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead.
for
If you generate the page dynamically to contain an image located at a domain that you control, e.g.
<img src="http://123123.deanonymize.mydomain.com"/>
...
8
A spoofed packet is a packet with a fake source IP address. To detect an incoming packet as spoofed, firewalls try to apply "local rules": they reject the packet if its coming from a link which is nominally incompatible with the alleged source address. For instance, if a firewall is between an internal network, with a known IP range, and the wide Internet, ...
8
I'd say you're right! They don't seem to have kept in mind that the HTTP header X-FORWARDED-FOR might return '; DROP TABLE users;--.
They suggest this in order to also lock sessions for people behind proxies, and name Tor as example. This is sort of stupid; Tor never forwards the original IP for obvious reasons. Moreover, it doesn't (shouldn't?) even look ...
7
An idle scan depends on source spoofing. However, many routers are configured to drop traffic with an obviously wrong source IP. Many ISPs will block obviously spoofed addresses both outbound and inbound, so using this depends heavily on getting the attacking box into the right network segment.
You said "security risk today," and the following is more ...
7
Sometimes the connection information inside a packet is predictable. TCP initial sequence numbers, for example, can be an issue if they are not random. See http://www.networkcomputing.com/unixworld/security/001.txt.html for one example. The same thing can also happen with DNS request ids.
Usually these attacks don't work on the first try, but will with ...
7
If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof.
Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...
7
The deal is that dnsadvantage.com is being used as at least one of your name servers and ak1s.abmr.net had a failed dns lookup (oops). dnsadvantage provides free DNS lookups in exchange for doing a MITM attack for domains that it cannot find. The page that it serves for these failed lookups is search.dnsadvantage.com and it displays google ads.
So try ...
7
Running as root with raw sockets will let you set whatever IP address you wish on your outgoing packets. Tools like hping3 include this functionality. You could write the binary GET request and feed it as an option to hping3, then specify the source address (or even --rand-source). That won't get you all the way, though.
Since we're talking about completing ...
7
First of all, I need to emphasize that IP address can never be used to authenticate a user, it can only be used to (attempt to) validate a host. Even if IP address were perfectly tied to an exact computer on an exact network port, we'd still have no guarantee that a particular user was at the console of that computer at that time. So if you are trying to ...
7
Defining a spoofed packet
First off, there's the concept of ownership of an IP range. I'll say anything that isn't coming from the registered owner or delegate of an IP block from IANA (and the subsidiaries, and the delegating ISPs) is a spoof.
It's all about routing
There are a few things to consider when talking about spoofing. The first is that you can ...
6
In the general case, it can be very difficult to differentiate packets with spoofed addresses. Most systems (servers or network devices) will only have a single NIC, so all traffic will come in on the same port. Static MAC entries can help mitigate collateral damage, but very quickly becomes a management nightmare. One of the few places you can detect and ...
6
I found an article here which describes some legit examples for spoofing IP:
In mobile IP environments, where a roaming host must use a "home" IP address in a foreign network (ref. C. Perkins, "IP Mobility Support for IPv4)
virtual private networks that set the host IP to an address local to the organization's network
6
Ars Technica just posted an article: "How the FBI investigates the hacktivities of Anonymous". It contains some information about how they go about tracing the members, and why it's hard.
Only top voted, non community-wiki answers of a minimum length are eligible
