Can someone steal my IP address and use it as their own?

Question

I am not talking about home networks (like hacking my wifi and using it). Can someone from another geographical location steal my IP address in some way?

For example:

I am angry with you. -> I want to make you suffer and managed to find your IP address. -> I decided to steal your IP address (meaning replace my IP address with yours) in such a way that what ever I do the feds going to be coming after you. -> So I bought some illegal drugs from the dark web (with my replaced IP address). -> The feds catches you.

Is this scenario possible?

Answer 1

Network engineer with Border Gateway Protocol (BGP) experience here.

Yes. But usually the attack would have to be for a larger address block and (as Eevee commented) require an attacker with specific skills and access. If someone calls you and claims that your IP is hacked, they are probably a scammer. Hang up!

Back to the question:

Let’s assume the “good ISP” company is allocated 1.1.0.0/16. You are a customer of “good ISP” and your home router public IP address is 1.1.5.5.

“EvilCo” wants to make you look bad by downloading ...inappropriate... content from 1.1.5.5. They have an unfiltered BGP routing protocol connection to the Internet and advertise 1.1.5.5/32.

That attack fails. While their BGP connection is not filtered (and we are talking about route advertisement filters here, not packet filters), Internet ISPs generally don’t accept IPv4 routes more specific than a /24.

So EvilCo advertises 1.1.5.0/24 in BGP. That succeeds. Both 1.1.5.0/24 and 1.1.0.0/16 exist in the core Internet routing table and the more specific route wins!

A few mitigations:

1. ISPs generally filter BGP connections to their customers and only accept specific routes, but there are plenty of unfiltered BGP connections out there (I personally had access to one in a prior job...it was so old it was created before the ISP tightened their standard configs).
2. Good BGP operators use a “BGP monitoring service” which sends them an email when someone else advertises one of their assigned blocks. (BGPmon)
3. There are “route registry databases” (RADB for example) and some ISPs try to police their routes with the databases, but those databases are generally incomplete.
4. The requirement to attack a larger block (/24) makes the attack more obvious, since multiple people are affected and all BGP updates are logged by several organizations.

It is also possible for a rogue operator inside “Good ISP” to specifically take over your /32.

It is always possible for anyone to send traffic with a source IP of 1.1.5.5 without rerouting the block, but that will not result in completed TCP handshakes so no downloads will occur (DNS queries are usually single-packet UDP, so it is easy for someone to forge DNS queries from your IP address for an inappropriate domain and send it to an arbitrary DNS server where the query might be logged).

There's a pretty good discussion and history of “BGP hijacking” incidents on Wikipedia. Network operator organizations including NANOG (North American Network Operators Group) communicate and cooperate to deal with (or at least bring visibility to) these when they occur.

Many (most?) BGP hijacking incidents are “operator error” rather than intentional. In some cases companies find IPv4 address space that is assigned to a no-longer-operational entity and use that for business operations. IPv4 address space is scarce and expensive due to IP address depletion.

Answer 2

If someone manage to get a backdoor program installed on your computer, they can route all their traffic through it using it as a proxy server, thus "stealing" your ip.

All their activity will show as coming from your ip address, so they can do shady stuff using your ip as cover and you might take the blame later.

Answer 3

NOTE:-I am only writing this because other answer talks of BGP hijacking which is sophisticated and will be quite noisy and the other answer touches on the malware subject but does't give details.

Can a guy from another geographical location steal my IP address in someway?

Oh absolutely,if i for example were to "steal your IP address" or in other terms make http request coming from your location,the easiest way to do it would be to get code execution in your system.From there i could drop a shell and route all traffic from your computer using proxy. Hell you could even write a very small version of that yourself in C.

1. Once your malware establishes socket connection,the client can send and receive data.All you need to do is send data from C&C network. For example you could just write www.google.com and send the data to client.
2. The client will receive that data and then you call getaddrinfo,make up a valid http request and send it to google.com.(For https you would use something like libcurl)
3. For google.com(their web server) the request will originate from your computer IP address,hence effectively stealing your Ip address.

the same applies for file downloading and rest of the internet

BTW the same technique is used by BOTNETS to effectively perform DDOS attacks where the originating IP is of victims.

Answer 4

To simplify some of the responses made here to something a little clearer.

Yes, it is technically possible to steal someone's IP address but it would be extremely difficult. Michael is correct that someone could theoretically advertised your address block from a rogue BGP AS* but unless your ISP provided you an IP address that was portable(meaning it could leave the ISP's AS) it would be rejected by virtually all core providers.

Many, although not all, providers require that router advertisements are installed via registries like RADB.

Furthermore, to insert the routes into BGP you would need to coopt a legitimate ISP. You can't just spin up a router instance and connect it to a ISP BGP instance and be off and running. The ISPs are not going to be too keen on rogue route advertisements.

And even if that all happened, there would be a record of the poison route being inserted and when it was removed so it would be pretty easy to prove it wasn't you.

It would be far easier, although certainly not that easy, to coopt a user's desktop and install malware that would appear to be you doing whatever it is you wanted to do.

*: BGP AS is the identifier that BGP routers use to tell other BGP routers who they are organizationally.

Answer 5

No, they cannot.

Theoretically, everything is possible when it concerns Internet (how do you know I'm not a smart dog with fingers?), but he'd have to spend a few, or many, millions of $ to set it up. And this diversion would be detected within a seconds and repaired, so it's a huge waste of $ for revenge. I can come up with much cheaper and more efficient ways.

Eg. example in the question - it'd be much cheaper to order some drugs off ze dark web to your home address with your name on the order, then tip off the local police. What happens then - who knows, probably nothing, they have limited budgets and cannot afford to chase ghosts.

"Buying from your IP address" - this is a teenager's feverish dream, nobody cares about that level of evidence unless the person they are investigating is, I don't know, a successful terrorist of the scale of 9-11.