Tag Info

Hot answers tagged

26

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


8

"Analysis": The fact that actual login attempts were made, tells you that the attacker was able to set up connections to the mail host . Since, in order to receive information over the Internet, you must be in control of the IP address you are using, this cannot be a case of address spoofing. (Attackers may send you information using spoofed addresses, as ...


6

It may be a Botnet with many different Computers in different countries. It has the advantage (for the hacker) that it is almost impossible to block for you (or your mail provider) because there is no IP that can be blocked. I don't know you, or your mail account, but if it is a normal account without important information in it there is a big chance that ...


6

Spoofing an IP address is possible, though not very easy to do for the average person. The reason being that most ISP's will drop spoofed packets as they leave your network. This is even more applicable to bogons as they are generally filtered at the ISP level, and border firewalls. If a spoofed packet does make it to your server, you should understand ...


5

You should block those addresses for all traffic because there is no valid reason for a packet bound from or to one of those addresses to be on the Internet at large. Any packet with one of those addresses represents an attack, a misconfiguration, or both. 0.0.0.0/8: A set of "wildcard" addresses representing the current network. 127.0.0.0/8: The loopback ...


3

What is one of the best ways to determine whether or not a user is abusing IPs? There's no good way, and it probably shouldn't be your goal. The fact that you've been "tracking actively-used IP addresses for each user" means that you already have a tracking mechanism better than IP addresses that you should use instead. As we've been tracking ...


3

I'd like to answer how these "Skype resolvers" actually work. When searching for info about these resolvers the only thing you'll find is stupid "tutorials" about kids making their own resolvers where in reality they're just calling a third-party API and displaying whatever they get back from that. What happens on these "third-party APIs" is a bit more ...


3

This file is a configuration file for some kind of antique unsecured ancestor of ssh: rsh (Remote SHell, more info including syntax example here). This antique tool relies its security on TCP three-way handshake in order to trust that a remote host is really who it pretends to be. Due to ISN prediction, you already know this was a weak way of ...


3

That is what VirtualBox's host-only networking mode is for. It creates a virtual network adaptor on the host and connects it to a virtual network adaptor in the guest. Then you just tell the services running on the host to only listen on the virtual adaptor. See section 6.7 of the VirtualBox manual for more details.


2

Is it possible for a user to automatically generate ip addresses and fill my database with a ton of spam? Usually no. As the ISP DHCP leasing mechanisms nowadays try to pin a specific IP to a specific user as long as possible. They would need a zombie botnet of other people's computer to flood your system this way. Is it possible for a user to spoof ...


2

Looking at the first message, I see: Received: from [209.79.72.16] by web162306.mail.bf1.yahoo.com via HTTP; Fri, 30 May 2014 17:37:45 PDT That is probably the address of the router from which the mail originated, and not the address of a PC which would be behind the router. A search on 209.79.72.16 gives me some confusing information; it's either in ...


2

They can realize you are from a proxy if enough distinct traffic is coming from the end point of the proxy or if it is a published proxy end point. That doesn't mean they can tell who you are, but there are some large caveats. If "they" is a government agency with jurisdictional control over the proxy or the proxy isn't an encrypted VPN proxy or isn't ...


2

If you're a Python programmer you can use the Scapy interactive packet manipulation program to create your own packets and send them. You can also use it as a library within your own Python program. From within the interactive program here's how you can create an IP packet, change the source address, and send it. Scapy will use any default routes you have ...


1

Yes, anybody can set a static IP on any workstation assuming they have administrative control over it, same goes for mac addresses. IP filtering should only be one of many layers as it can be easily spoofed, and I wouldn't put too much weight on static IPs for security. An attacker would spoof one of the clients IP and MACs (can happen on any modern OS), ...


1

IP addresses are assigned to Internet Service Providers who assign them to customers. (Sometimes, but less frequently, a block of addresses may be assigned directly to a customer, such as IBM.) Sometimes IP addresses assigned to ISPs may be used for the ISP's internal operations, and not assigned to customers at all. Example: The IP address of an AT&T ...


1

An ISP should be able to identify the accountholder details (including address on file where applicable) and at least the street address corresponding to the IP at a given time when dealing with wired residential connections, but there is not much more. There are some circumstances under which it is simply not possible to identify a person based on their IP ...


1

Another way to determine the ip addresses of callers would be to look at the forensic artifacts. There are a few tools out there that will analyze the artifacts for you but you could determine all of what you need yourself. This article describes the process pretty well, but basically, all you are looking for is in the 'shared.xml' file. This method is ...


1

I think both posters are correct. Skype will or will not make a direct connection. For example, if you are sitting next to each other with a friend, go online in Skype and transmit a file between both of you. You should notice amazingly fast transmission speed, as Skype detects that you are located on the same network and therefore it makes a P2P connection. ...


1

As you have said other, presumably untrusted, computers are on the same network, your concerns are justified. Any of the other machines on the same network could set their IP address to that of server_a and send a request to server_b. I would suggest using client certificates and server certificates within your ssl configuration see ...


1

If you are directly on the path of the information, then there is absolutely nothing preventing you from pretending you are that IP address. If you were the first device along the network that Alice talked with, you could absolutely convince her that you are Bob's IP. This is a big part of why browsers require signed certificates in order to trust SSL ...


1

There are two ways to defend against IP spoofing in the general case (i.e. if you need to be compatible with all existing infrastructure and protocols): 1) Ingress filtering - Block all packets entering your network from the Internet that have a source or destination address that is invalid (private address ranges, reserved ranges, or a source address that ...


1

IP spoofing is forging a new IP datagram impersonating a different machine from your own. This is done by modifying the IP header, replacing the source address (your own) with a forged one. This is successfull because IP is a stateless protocol and (in addition) provides no type of integrity on its own. Any type of integrity control would prevent it such ...



Only top voted, non community-wiki answers of a minimum length are eligible