Tag Info

Hot answers tagged

26

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


10

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this ...


8

"Analysis": The fact that actual login attempts were made, tells you that the attacker was able to set up connections to the mail host . Since, in order to receive information over the Internet, you must be in control of the IP address you are using, this cannot be a case of address spoofing. (Attackers may send you information using spoofed addresses, as ...


7

Yes it can be done. It's trivial. There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head. These all assume that the IP address of the target system is exposed to your server. Either you're running some code (like JavaScript) to detect the IP address, or the client ...


6

It may be a Botnet with many different Computers in different countries. It has the advantage (for the hacker) that it is almost impossible to block for you (or your mail provider) because there is no IP that can be blocked. I don't know you, or your mail account, but if it is a normal account without important information in it there is a big chance that ...


6

Your question seems to indicates you do not understand how IP works, how IP routing works and how TCP is implemented on top of it (and incidentally, what IP address spoofing really means) Routing IP implements a routed datagram protocol: each datagram (packet) has (among other things) a source address, a destination address and a payload (there are many ...


6

I'd say that there can be a benefit from using static IP addresses. Essentially if at the firewall you can say "only allow traffic to this port from these specific IP addresses" then there are a number of effects. An attacker scanning the Internet for vulnerable hosts is unlikely to detect the service and therefore be able to attack it An attacker who is ...


6

Spoofing an IP address is possible, though not very easy to do for the average person. The reason being that most ISP's will drop spoofed packets as they leave your network. This is even more applicable to bogons as they are generally filtered at the ISP level, and border firewalls. If a spoofed packet does make it to your server, you should understand ...


5

You should block those addresses for all traffic because there is no valid reason for a packet bound from or to one of those addresses to be on the Internet at large. Any packet with one of those addresses represents an attack, a misconfiguration, or both. 0.0.0.0/8: A set of "wildcard" addresses representing the current network. 127.0.0.0/8: The loopback ...


4

He is referring to an attack such as a DNS Amplification Attack. He is not increasing his upstream, but he would be increasing the amount of data being sent to the target. To make it simple: Your friend (1.2.3.4) wants to attack some server (6.7.8.9). He spoofs his address to appear to come from the server (6.7.8.9). He sends a DNS request to third party ...


4

It's less of a matter of if the attacker can change their IP and more of a matter of good practice. If you don't have a captcha on your page, even initally, it allows for automated form submission which you definitely do not want. For example, an attacker that controls a botnet can target you, and then all IPs on the botnet would be different. The attacker ...


4

This is safe in general, though you should be concerned about any services on those machines that are exposed via stateless protocols such as UDP, as the source address can be spoofed. As such, if an attacker knows the IP, they could still send UDP traffic through the firewall by faking the source IP. If you've got no UDP-based protocols exposed then the ...


3

That is what VirtualBox's host-only networking mode is for. It creates a virtual network adaptor on the host and connects it to a virtual network adaptor in the guest. Then you just tell the services running on the host to only listen on the virtual adaptor. See section 6.7 of the VirtualBox manual for more details.


3

Easiest way to be a bit more secure is to place the list of IP adresses in a password-protected zip file. 7-zip does this, it's free, uses AES-256, and can also encrypt the files inside in addition to the archive itself. Then you can give the other party the password to the zip file over the phone or via text message. Not failsafe by any means, but does ...


3

I'm just going to answer (very) generally and let you do the math. IP address spoofing works just like any other form of spoofing. Spoofing means pretending to be someone who you aren't. In the context of information security, IP address spoofing (henceforth refereed to simply as "spoofing") is quite common in many attacks. For example to target systems ...


2

Under normal circumstances, the NAT / PAT rules on the router will change the source IP address to its own (public) address. This is done by the router/gateway itself, and can not be set by a client (unless [mis]configured to do so). The target webserver will still get packets from the real (public) IP address.


2

Is it possible for a user to automatically generate ip addresses and fill my database with a ton of spam? Usually no. As the ISP DHCP leasing mechanisms nowadays try to pin a specific IP to a specific user as long as possible. They would need a zombie botnet of other people's computer to flood your system this way. Is it possible for a user to spoof ...


2

Looking at the first message, I see: Received: from [209.79.72.16] by web162306.mail.bf1.yahoo.com via HTTP; Fri, 30 May 2014 17:37:45 PDT That is probably the address of the router from which the mail originated, and not the address of a PC which would be behind the router. A search on 209.79.72.16 gives me some confusing information; it's either in ...


2

They can realize you are from a proxy if enough distinct traffic is coming from the end point of the proxy or if it is a published proxy end point. That doesn't mean they can tell who you are, but there are some large caveats. If "they" is a government agency with jurisdictional control over the proxy or the proxy isn't an encrypted VPN proxy or isn't ...


2

If you're a Python programmer you can use the Scapy interactive packet manipulation program to create your own packets and send them. You can also use it as a library within your own Python program. From within the interactive program here's how you can create an IP packet, change the source address, and send it. Scapy will use any default routes you have ...


1

If you are directly on the path of the information, then there is absolutely nothing preventing you from pretending you are that IP address. If you were the first device along the network that Alice talked with, you could absolutely convince her that you are Bob's IP. This is a big part of why browsers require signed certificates in order to trust SSL ...


1

There are two ways to defend against IP spoofing in the general case (i.e. if you need to be compatible with all existing infrastructure and protocols): 1) Ingress filtering - Block all packets entering your network from the Internet that have a source or destination address that is invalid (private address ranges, reserved ranges, or a source address that ...


1

IP spoofing is forging a new IP datagram impersonating a different machine from your own. This is done by modifying the IP header, replacing the source address (your own) with a forged one. This is successfull because IP is a stateless protocol and (in addition) provides no type of integrity on its own. Any type of integrity control would prevent it such ...


1

It Certainly would reduce the exposure and increase the obscurity of the connection to narrow the possible connections to a small sub group of specific IP addresses. What would be a safer approach is to have your users connect to a VPN endpoint and then connect to that system from there, This obfuscates the traffic with encryption and makes it un-viewable ...


1

Sounds a lot like SYN Cookies. This is a method to prevent TCP SYN DoS attacks. Basically, when the server receives a TCP SYN packet, it creates a "cookie" with a hash of the values (specifically the source and sequence number), and then sends the ACK but does not create a "half open" connection. When the server receives a SYNC ACK, it uses the ...


1

First thing that would come to my mind: a simple list of proxy servers that an attacker can use to make many signup or any other action, pretending he's many different users. Typically, this could be used to bypass security for online votations, contests etc. and from an attacker point of view, this is probably the easiest way to go (script to automate ...


1

A DDoS attack is usually just a shitload of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc... But, knowing that a DDoS is distributed, you'd need to ...


1

I hate to say the answer is yes/no but given the information I have to and I will explain why. It really depends on your guests and your level of paranoia/how much time you want to spend administering this AP. You can write iptable rules to keep a guest from gaining information about/accessing your internal network but you pretty much have to write a rule ...



Only top voted, non community-wiki answers of a minimum length are eligible