Tag Info

Hot answers tagged

10

Short answer: no. Longer answer: yes, if you control a router device close to the target device (it has to be on the path between the the real source IP address and the target, and on the path between the faked IP address and the target) or if the target network/host accepts source-routed packets.


9

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this ...


7

Yes it can be done. It's trivial. There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head. These all assume that the IP address of the target system is exposed to your server. Either you're running some code (like JavaScript) to detect the IP address, or the client ...


6

I'd say that there can be a benefit from using static IP addresses. Essentially if at the firewall you can say "only allow traffic to this port from these specific IP addresses" then there are a number of effects. An attacker scanning the Internet for vulnerable hosts is unlikely to detect the service and therefore be able to attack it An attacker who is ...


6

A proxy is a system which relays communications. From your server, you see the communication as coming from the proxy machine. The IP address you see is the one of the proxy. If you block that IP, you block all traffic coming from that proxy, but no traffic from elsewhere. If the villain switches to another proxy, he will pass. Some HTTP proxy add a header ...


6

We can but... At the point the query makes it to your server it's already too late. Your server will waste its resources trying to do something with the packets and the requests. Even if you have something like iptables drop all connections it's still going to use up all of the bandwidth on the server inbound. Redirecting all traffic someplace else eats up ...


5

Your question seems to indicates you do not understand how IP works, how IP routing works and how TCP is implemented on top of it (and incidentally, what IP address spoofing really means) Routing IP implements a routed datagram protocol: each datagram (packet) has (among other things) a source address, a destination address and a payload (there are many ...


4

A side channel attack is a classification of attacks and not specific to any one exploit. Therefore referring to a "side channel attack" could mean any number of threats. The only side channel attack that I know of involving printers is an acoustic side channel attack. It is impossible for an attacker to spoof their IP address over the open internet due ...


4

Short answer: Yes, but not as possible as it used to be, and dependent upon how literally one takes your question. Long answer: I notice that you did not ask "Is it possible to carry on a TCP conversation with a spoofed IP address" - that question was ably answered by @symcbean. You specifically asked "Is it possible to pass TCP handshake with spoofed IP ...


4

He is referring to an attack such as a DNS Amplification Attack. He is not increasing his upstream, but he would be increasing the amount of data being sent to the target. To make it simple: Your friend (1.2.3.4) wants to attack some server (6.7.8.9). He spoofs his address to appear to come from the server (6.7.8.9). He sends a DNS request to third party ...


4

It's less of a matter of if the attacker can change their IP and more of a matter of good practice. If you don't have a captcha on your page, even initally, it allows for automated form submission which you definitely do not want. For example, an attacker that controls a botnet can target you, and then all IPs on the botnet would be different. The attacker ...


4

This is safe in general, though you should be concerned about any services on those machines that are exposed via stateless protocols such as UDP, as the source address can be spoofed. As such, if an attacker knows the IP, they could still send UDP traffic through the firewall by faking the source IP. If you've got no UDP-based protocols exposed then the ...


3

I'm just going to answer (very) generally and let you do the math. IP address spoofing works just like any other form of spoofing. Spoofing means pretending to be someone who you aren't. In the context of information security, IP address spoofing (henceforth refereed to simply as "spoofing") is quite common in many attacks. For example to target systems ...


3

Easiest way to be a bit more secure is to place the list of IP adresses in a password-protected zip file. 7-zip does this, it's free, uses AES-256, and can also encrypt the files inside in addition to the archive itself. Then you can give the other party the password to the zip file over the phone or via text message. Not failsafe by any means, but does ...


3

The problem is that you need to drop the traffic before it reaches your network. So even when dropping packets at your server is way too late. The best way to reduce risk is to use packet scrubbing services like Akamai or Cloudfare who have DDoS mitigation techniques in place to prevent this traffic from reaching your network.


2

A network switch works by inspecting packets as they come and go. When a switch sees that a packet arrives on a given port, bearing the source MAC address X, then the switch remembers that the machine with MAC address X lies at some point beyond that port, and packets destined to the MAC address X will be sent to that port. Note that switches don't care ...


2

I am not a lawyer, but it doesn't sound like any crime was committed, so the police aren't going to be able to help you. You can talk to a lawyer in your jurisdiction to be sure if any laws apply in this case, but if you publicly posted pictures, then they didn't steal anything by using them unless you had copyright notices posted with the images. If a ...


2

+1 for X-Forwaded-For and riders. Proxy or not, with enough examples of attacks to work from, it may be possible to close in on the sources. For example, a report this year from information security company Mandiant (http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf) identified individuals and very precisely the part of a building in China as a ...


2

Without access to the network behind one of the allowed IP addresses or access to a machine behind one of the allowed IP addresses, you can not pass a TCP 3-way handshake with a spoofed IP address.


2

The simplest answer is that negotiating an IPSec connection requires mutual authentication, which is a way to prove the identity of the entity behind the IP address. All subsequent communications are cryptographically sound, such that there's no way you can carry on those communications unless you went through the mutual authentication phase. An attacker ...


2

Under normal circumstances, the NAT / PAT rules on the router will change the source IP address to its own (public) address. This is done by the router/gateway itself, and can not be set by a client (unless [mis]configured to do so). The target webserver will still get packets from the real (public) IP address.


1

It Certainly would reduce the exposure and increase the obscurity of the connection to narrow the possible connections to a small sub group of specific IP addresses. What would be a safer approach is to have your users connect to a VPN endpoint and then connect to that system from there, This obfuscates the traffic with encryption and makes it un-viewable ...


1

First thing that would come to my mind: a simple list of proxy servers that an attacker can use to make many signup or any other action, pretending he's many different users. Typically, this could be used to bypass security for online votations, contests etc. and from an attacker point of view, this is probably the easiest way to go (script to automate ...


1

A DDoS attack is usually just a shitload of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc... But, knowing that a DDoS is distributed, you'd need to ...


1

I hate to say the answer is yes/no but given the information I have to and I will explain why. It really depends on your guests and your level of paranoia/how much time you want to spend administering this AP. You can write iptable rules to keep a guest from gaining information about/accessing your internal network but you pretty much have to write a rule ...


1

This probably is a botnet who tries to find other hosts to infect in an automatic fashion. Most probably, a lot of other systems are similarly targeted, and were randomly selected. It is the lot of any remotely accessible service to receive such bogus login attempts. Since they come from botnets, who, by definition, use many IP addresses, IP-banning ...


1

From your description it sounds like it is a botnet of some kind. But that information is unlikely to help in any way. You are unlikely to ever see the script that is running (or the C&C commands being sent to the botnet) so that avenue of defence is unlikely...unless you are the FBI or similar. And botnets can have any IP address and be anywhere. ...


1

The uplink will still be saturated. The only way to mitigate this is to turn on RRL on servers and get ride of open resolvers. And for legitimate open resolvers, have them send UDP packets as small as possible with the TC bit set ("please retry using TCP") so that amplification doesn't happen yet it doesn't break legitimate traffic. Other mitigation ...


1

The only sane protection against DDoS attacks is deploying a service like CloudFlare. The very nature of a DDoS attack makes it difficult to detect and stop. How are you going to distinguish between malicious and normal traffic? Even if you have such a means, performing analysis on every single connect attempt on your server is probably going to overload ...


1

What you are describing is called DHCP Snooping and IP Source Guard and is implemented on most better managed Layer 2 Switches. It works like this: When the switch sees a MAC address it doesn't know it will only let DHCP Requests from that address pass. All other traffic will be dropped. If the DHCP server responds with an IP address the switch will ...



Only top voted, non community-wiki answers of a minimum length are eligible