Tag Info

Hot answers tagged

10

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this ...


7

Yes it can be done. It's trivial. There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head. These all assume that the IP address of the target system is exposed to your server. Either you're running some code (like JavaScript) to detect the IP address, or the client ...


6

I'd say that there can be a benefit from using static IP addresses. Essentially if at the firewall you can say "only allow traffic to this port from these specific IP addresses" then there are a number of effects. An attacker scanning the Internet for vulnerable hosts is unlikely to detect the service and therefore be able to attack it An attacker who is ...


6

Your question seems to indicates you do not understand how IP works, how IP routing works and how TCP is implemented on top of it (and incidentally, what IP address spoofing really means) Routing IP implements a routed datagram protocol: each datagram (packet) has (among other things) a source address, a destination address and a payload (there are many ...


6

Spoofing an IP address is possible, though not very easy to do for the average person. The reason being that most ISP's will drop spoofed packets as they leave your network. This is even more applicable to bogons as they are generally filtered at the ISP level, and border firewalls. If a spoofed packet does make it to your server, you should understand ...


5

You should block those addresses for all traffic because there is no valid reason for a packet bound from or to one of those addresses to be on the Internet at large. Any packet with one of those addresses represents an attack, a misconfiguration, or both. 0.0.0.0/8: A set of "wildcard" addresses representing the current network. 127.0.0.0/8: The loopback ...


4

He is referring to an attack such as a DNS Amplification Attack. He is not increasing his upstream, but he would be increasing the amount of data being sent to the target. To make it simple: Your friend (1.2.3.4) wants to attack some server (6.7.8.9). He spoofs his address to appear to come from the server (6.7.8.9). He sends a DNS request to third party ...


4

It's less of a matter of if the attacker can change their IP and more of a matter of good practice. If you don't have a captcha on your page, even initally, it allows for automated form submission which you definitely do not want. For example, an attacker that controls a botnet can target you, and then all IPs on the botnet would be different. The attacker ...


4

This is safe in general, though you should be concerned about any services on those machines that are exposed via stateless protocols such as UDP, as the source address can be spoofed. As such, if an attacker knows the IP, they could still send UDP traffic through the firewall by faking the source IP. If you've got no UDP-based protocols exposed then the ...


3

That is what VirtualBox's host-only networking mode is for. It creates a virtual network adaptor on the host and connects it to a virtual network adaptor in the guest. Then you just tell the services running on the host to only listen on the virtual adaptor. See section 6.7 of the VirtualBox manual for more details.


3

Easiest way to be a bit more secure is to place the list of IP adresses in a password-protected zip file. 7-zip does this, it's free, uses AES-256, and can also encrypt the files inside in addition to the archive itself. Then you can give the other party the password to the zip file over the phone or via text message. Not failsafe by any means, but does ...


3

I'm just going to answer (very) generally and let you do the math. IP address spoofing works just like any other form of spoofing. Spoofing means pretending to be someone who you aren't. In the context of information security, IP address spoofing (henceforth refereed to simply as "spoofing") is quite common in many attacks. For example to target systems ...


2

The simplest answer is that negotiating an IPSec connection requires mutual authentication, which is a way to prove the identity of the entity behind the IP address. All subsequent communications are cryptographically sound, such that there's no way you can carry on those communications unless you went through the mutual authentication phase. An attacker ...


2

Under normal circumstances, the NAT / PAT rules on the router will change the source IP address to its own (public) address. This is done by the router/gateway itself, and can not be set by a client (unless [mis]configured to do so). The target webserver will still get packets from the real (public) IP address.


2

Looking at the first message, I see: Received: from [209.79.72.16] by web162306.mail.bf1.yahoo.com via HTTP; Fri, 30 May 2014 17:37:45 PDT That is probably the address of the router from which the mail originated, and not the address of a PC which would be behind the router. A search on 209.79.72.16 gives me some confusing information; it's either in ...


2

They can realize you are from a proxy if enough distinct traffic is coming from the end point of the proxy or if it is a published proxy end point. That doesn't mean they can tell who you are, but there are some large caveats. If "they" is a government agency with jurisdictional control over the proxy or the proxy isn't an encrypted VPN proxy or isn't ...


2

If you're a Python programmer you can use the Scapy interactive packet manipulation program to create your own packets and send them. You can also use it as a library within your own Python program. From within the interactive program here's how you can create an IP packet, change the source address, and send it. Scapy will use any default routes you have ...


2

Is it possible for a user to automatically generate ip addresses and fill my database with a ton of spam? Usually no. As the ISP DHCP leasing mechanisms nowadays try to pin a specific IP to a specific user as long as possible. They would need a zombie botnet of other people's computer to flood your system this way. Is it possible for a user to spoof ...


1

It Certainly would reduce the exposure and increase the obscurity of the connection to narrow the possible connections to a small sub group of specific IP addresses. What would be a safer approach is to have your users connect to a VPN endpoint and then connect to that system from there, This obfuscates the traffic with encryption and makes it un-viewable ...


1

There are two ways to defend against IP spoofing in the general case (i.e. if you need to be compatible with all existing infrastructure and protocols): 1) Ingress filtering - Block all packets entering your network from the Internet that have a source or destination address that is invalid (private address ranges, reserved ranges, or a source address that ...


1

IP spoofing is forging a new IP datagram impersonating a different machine from your own. This is done by modifying the IP header, replacing the source address (your own) with a forged one. This is successfull because IP is a stateless protocol and (in addition) provides no type of integrity on its own. Any type of integrity control would prevent it such ...


1

Sounds a lot like SYN Cookies. This is a method to prevent TCP SYN DoS attacks. Basically, when the server receives a TCP SYN packet, it creates a "cookie" with a hash of the values (specifically the source and sequence number), and then sends the ACK but does not create a "half open" connection. When the server receives a SYNC ACK, it uses the ...


1

First thing that would come to my mind: a simple list of proxy servers that an attacker can use to make many signup or any other action, pretending he's many different users. Typically, this could be used to bypass security for online votations, contests etc. and from an attacker point of view, this is probably the easiest way to go (script to automate ...


1

A DDoS attack is usually just a shitload of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc... But, knowing that a DDoS is distributed, you'd need to ...


1

I hate to say the answer is yes/no but given the information I have to and I will explain why. It really depends on your guests and your level of paranoia/how much time you want to spend administering this AP. You can write iptable rules to keep a guest from gaining information about/accessing your internal network but you pretty much have to write a rule ...


1

As the author of Bad Behavior, I've seen these botnet attacks before. I'm proud to say that Bad Behavior is still the only tool that blocks their first attempt and without resorting to IP bans. The briefest glance at your log was enough to show that they are all compromised web servers, a very familiar pattern. One can easily infer that they are under some ...


1

This probably is a botnet who tries to find other hosts to infect in an automatic fashion. Most probably, a lot of other systems are similarly targeted, and were randomly selected. It is the lot of any remotely accessible service to receive such bogus login attempts. Since they come from botnets, who, by definition, use many IP addresses, IP-banning ...


1

From your description it sounds like it is a botnet of some kind. But that information is unlikely to help in any way. You are unlikely to ever see the script that is running (or the C&C commands being sent to the botnet) so that avenue of defence is unlikely...unless you are the FBI or similar. And botnets can have any IP address and be anywhere. ...



Only top voted, non community-wiki answers of a minimum length are eligible