Websocket connection spoofing

Question

I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically identified by local address:port and remote address:port, if we suppose that an attacker can find out a victim's IP address and the exact local port they are connected from, and we also suppose that the attacker is aware of the software architecture of the server and knows exactly what information he needs to send where, would they be able to spoof and send packets in a way such that the server would think they are legitimately coming from the victim's machine?

Answer 1

Even with plain unencrypted Websocket the attacker can not easily spoof the connection. The attacker would not only need to spoof the IP address which might be kind of simple. But it must spoof the IP address for a TCP connection which is much harder since it not only needs to spoof the IP address but also use the correct TCP sequence numbers expected by the peer. Guessing must be done since because of the spoofed IP address the attacker cannot see the packets send from the server to the spoofed client.

While it might be possible to guess the sequence number correctly for a single TCP packet right it gets much harder to keep guessing correctly since the attacker does not get any feedback which of the previous guesses was correct. Additionally it is not unlikely that the real client will actually send a RST on the spoofed connection since it receives packets from the server which don't correlate to an existing connection. This will immediately close the connection at the server side.

Thus, it might be possible for exchanging a few packets but it is more or less impossible to keep a Websocket connection running with a spoofed IP address for some significant time.

Answer 2

Yes. If the connection isn't encrypted (for example TLS) and the attacker is able to spoof his IP (which isnt hard) in this scenario he can even make a Man in The Middle Attack by putting himself in a position where he can receive the packages from the Client, analyze them and pass them to the Server.