3

People Generally spoof their IP address by using any other device's ip address such as printer, scanner. My question is in this kind of particular attack why we are using these devices rather than traditional ones such as desktop computers, laptops.

I predicted that It is because generally scanners, printers and all these kind of devices remain silent then those ones. Just make me correct is my predication is correct ?

And is there anyway that we can build our custom silent device somewhere else on other network and then we spoof our IP address by using side channel attack to determine whether the port is opened at our desired server or not !?

And also want to know that how to predict IPID in side channel attack when we are receiving RST from zombie( the device who's IP we are going to spoof). General packet will be in form of like this

RST:IPID=3020 or any number.

Thank you.

Improve this question

1 Answer 1

Reset to default
4

A side channel attack is a classification of attacks and not specific to any one exploit. Therefore referring to a "side channel attack" could mean any number of threats. The only side channel attack that I know of involving printers is an acoustic side channel attack.

It is impossible for an attacker to spoof their IP address over the open internet due to the three way handshake:

enter image description here

I don't believe there is any side channel attack involving ip address spoofing... These two attack patterns are fundamentally disjoint because the network is one channel, so what is the "side channel" in a spoofing attack?

In terms of local network attacks, there is the pwnplug. It is also possible to hack printers and other network hardware using CSRF and this could provide a beachhead into a network.

Improve this answer
2
  • I am asking because i have seen somewhere that many people are using printer or scanner's ip address with nmap command for just information gathering about target that hw many and which ports are open and closed. So my question of ip spoofing is relatd to this topic. IN my question scanner and printer are called zombies as u know.
    – FrOgY
    Commented Jun 9, 2013 at 20:01
  • @Chintan Tw1stER Gurjar The ability to spoof your ip address with nmap is to cause confusion in NIDS logs, this is not a valid method of scanning anonymously, the three way handshake makes this impossible. Here are methods of scanning anonymously with nmap: security.stackexchange.com/questions/12762/… Perhaps you are thinking of an idle scan? I don't think anyone uses these anymore...
    – rook
    Commented Jun 9, 2013 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .