Tag Info

Hot answers tagged

27

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


13

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port ...


8

"Analysis": The fact that actual login attempts were made, tells you that the attacker was able to set up connections to the mail host . Since, in order to receive information over the Internet, you must be in control of the IP address you are using, this cannot be a case of address spoofing. (Attackers may send you information using spoofed addresses, as ...


6

It may be a Botnet with many different Computers in different countries. It has the advantage (for the hacker) that it is almost impossible to block for you (or your mail provider) because there is no IP that can be blocked. I don't know you, or your mail account, but if it is a normal account without important information in it there is a big chance that ...


3

As explained by the answer of gowenfawr you can not change the IP of a TCP session. However there are some options to have a TCP connection while spoofing the source IP. All that IP-spoofing does is change the Source IP address of the packet you send. This is done on the routing (IP) layer of the network stack. The server will threat this spoofed packet as ...


3

That is what VirtualBox's host-only networking mode is for. It creates a virtual network adaptor on the host and connects it to a virtual network adaptor in the guest. Then you just tell the services running on the host to only listen on the virtual adaptor. See section 6.7 of the VirtualBox manual for more details.


3

This file is a configuration file for some kind of antique unsecured ancestor of ssh: rsh (Remote SHell, more info including syntax example here). This antique tool relies its security on TCP three-way handshake in order to trust that a remote host is really who it pretends to be. Due to ISN prediction, you already know this was a weak way of ...


3

What is one of the best ways to determine whether or not a user is abusing IPs? There's no good way, and it probably shouldn't be your goal. The fact that you've been "tracking actively-used IP addresses for each user" means that you already have a tracking mechanism better than IP addresses that you should use instead. As we've been tracking ...


2

Is it possible for a user to automatically generate ip addresses and fill my database with a ton of spam? Usually no. As the ISP DHCP leasing mechanisms nowadays try to pin a specific IP to a specific user as long as possible. They would need a zombie botnet of other people's computer to flood your system this way. Is it possible for a user to spoof ...


2

There is a specific IETF RFC that addresses spoofed BGP source prefixes being advertised into a network. For an ISP the default is to trust the other ISP and it is up to your peers to enforce this rigorously and some do not. https://tools.ietf.org/html/draft-jdurand-bgp-security-00#section-4.1.2.2


1

X-Forwarded-For header may be used to forward client's real IP in case of source NAT. But not all application use them. This header is often inserted by load-balancers or reverse-proxies, depending the architecture in place, when the application needs to know the real IP belonging to a client. When this header is inserted, the application can see 2 IPs: ...


1

The attacker can still spoof the IP address and use bank's IP address, but the response from your website will go to the spoofed IP address (bank's IP address) and not to the attacker's actual IP address. Usually a TCP handshake is required to initiate a TCP connection. HTTP uses TCP. The attacker will send a SYN packet with spoofed IP(bank's IP), your ...


1

This sounds like a component of a broader targeted attack involving spear phishing. You might send a link to the victim for Banking.Example.com and begin your DNS reply spam for that domain. That way, you know which domain they are trying to resolve with DNS.


1

Yes, anybody can set a static IP on any workstation assuming they have administrative control over it, same goes for mac addresses. IP filtering should only be one of many layers as it can be easily spoofed, and I wouldn't put too much weight on static IPs for security. An attacker would spoof one of the clients IP and MACs (can happen on any modern OS), ...


1

IP addresses are assigned to Internet Service Providers who assign them to customers. (Sometimes, but less frequently, a block of addresses may be assigned directly to a customer, such as IBM.) Sometimes IP addresses assigned to ISPs may be used for the ISP's internal operations, and not assigned to customers at all. Example: The IP address of an AT&T ...


1

An ISP should be able to identify the accountholder details (including address on file where applicable) and at least the street address corresponding to the IP at a given time when dealing with wired residential connections, but there is not much more. There are some circumstances under which it is simply not possible to identify a person based on their IP ...


1

Another way to determine the ip addresses of callers would be to look at the forensic artifacts. There are a few tools out there that will analyze the artifacts for you but you could determine all of what you need yourself. This article describes the process pretty well, but basically, all you are looking for is in the 'shared.xml' file. This method is ...


1

I think both posters are correct. Skype will or will not make a direct connection. For example, if you are sitting next to each other with a friend, go online in Skype and transmit a file between both of you. You should notice amazingly fast transmission speed, as Skype detects that you are located on the same network and therefore it makes a P2P connection. ...


1

As you have said other, presumably untrusted, computers are on the same network, your concerns are justified. Any of the other machines on the same network could set their IP address to that of server_a and send a request to server_b. I would suggest using client certificates and server certificates within your ssl configuration see ...


1

If you are directly on the path of the information, then there is absolutely nothing preventing you from pretending you are that IP address. If you were the first device along the network that Alice talked with, you could absolutely convince her that you are Bob's IP. This is a big part of why browsers require signed certificates in order to trust SSL ...



Only top voted, non community-wiki answers of a minimum length are eligible