28

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive the returning packets.

Does anyone know how this poses as a security risk today?

Some risks:

  • SYN flooding from an IP that is not filtered.
  • Connection hijacking by learning the next sequence number
  • Bypass firewall and other defenses by acting as a legit source
  • IDLE scan
  • Smurf attack
  • DNS Cache Poisoning
Improve this question

6 Answers 6

Reset to default
22

You are correct when you say an attacker spoofing IP may not receive traffic back, but they may not want to. They may want traffic sent to another IP address - possibly for denial of service attack on that IP.

Alternatively, there are attacks which just require the initial part of the handshake to take down your defences (you mentioned SYN flood)

Less of a direct risk, but also relevant is general traffic load. My take on this is to disallow as much as you can at the perimeter - this includes traffic types and ports you don't use, and also traffic which is effectively invalid. It is simple to do on most routers, and it means any deep inspection firewall has to trawl through less packets thus reducing the load.

Improve this answer
1
  • 1
    +1 - I'm glad I read all the answers through before responding, I was just about to write the same thing (first paragraph - almost word for word :D )
    – AviD ♦
    Commented Dec 7, 2010 at 22:41
8

An idle scan depends on source spoofing. However, many routers are configured to drop traffic with an obviously wrong source IP. Many ISPs will block obviously spoofed addresses both outbound and inbound, so using this depends heavily on getting the attacking box into the right network segment.

You said "security risk today," and the following is more applicable to security risks tomorrow, but ipv6 poses some novel spoofing problems and solutions.

Improve this answer
1
  • 1
    Very nice mentioning idle scan! :)
    – Chris Dale
    Commented Dec 7, 2010 at 16:51
5

It's worth considering the risks of IP spoofing in connectionless protocols like UDP. Imagine a case where a firewall is restricting access to a set of allowed IP addresses. An attacker with knowledge of those allowed IP addresses could mount a targeted attack by sending well-crafted UDP packets to the listening service.

There are plenty of services which use connectionless protocols, DNS is a prominent one for example.

Like you said, with regards to TCP the usefulness of IP spoofing becomes much more limited since you cannot establish a full session which requires the special 3-way (or lesser known 4-way) handshake.

Improve this answer
5

IP spoofing covers more than just TCP.

The old school smurf attack relied on sending an ICMP ping requests to a broadcast address using a spoofed source address to DDoS a victim with all of the ICMP ping replies.

The most recent and mind-blowing attack IMHO is the DNS Poisoning Attack found by Dan Kaminsky. Check how many vendors are affected. Note: djbdns is not vulnerable and was specifically designed to defeat this attack.

Because attacks against these vulnerabilities all rely on an attacker's ability to predictably spoof traffic, the implementation of per-query source port randomization in the server presents a practical mitigation against these attacks within the boundaries of the current protocol specification. Randomized source ports can be used to gain approximately 16 additional bits of randomness in the data that an attacker must guess.

...

An attacker with the ability to conduct a successful cache poisoning attack can cause a nameserver's clients to contact the incorrect, and possibly malicious, hosts for particular services.

Poisoned DNS allows for attacking SSL, as noted in the answers to this SSL question.

Improve this answer
4

you will not be able to set up a full handshake by doing this

If the machines are on separate subnets, source routing is disabled and the routers are not compromised, then its not possible.

Anyone who uses host addresses as a primary security measure deserves what will happen to them.

While source routing is usually disabled by default on most IPv4 implementations, a lot of the functionality in IPv6 depends upon it.

And look at the stats - most security incidents are perpetrated by 'insiders'.

Improve this answer
0
1

Gotta add that it makes hack attempts investigation a little more difficult. If you weren't able to spoof then the IP address would be a direct connection back to your service.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .