Why attack detection based on the same user request from different places (e.g. by IP) is not widely used?

Question

There are many ways how an adversary can pretend that he is a legitimate user (like session cookie stealing, bruteforcing the password and what not), but as far as I can see it should be rather hard for them to go unnoticed if the system tries to protect against it, e.g. by detecting that the same user is logging in from a different IP within the short period of time and moreover continue to send requests from multiple IP's simultaneously. This seem rather evident that for most cases something spooky is going on.

• Is that really a good indication of a successful attack and system should try to prevent it somehow (I think e.g. google does)?
• I have not seen that this widely employed, is that because it's just rather expensive to implement or because of the fact that people tend to rely on preventing identity theft in the first place?

Answer 1

There are a few reasons that IPv4 addressing is not used in this way:

• IP addresses are not a foolproof indication of location. IP address blocks are assigned to companies and can be used anywhere they are required. A company in Asia may get a block from apnic, but then use part of their allocation in north America
• Systems get different IP addresses all the time for legitimate reasons. The user's home ADSL router may be assigned a different address, or the user may log in using WIFI at Starbucks, a change of IP address is not a good indicator of fraud
• A user may be using an anonymizer or VPN of some kind. A user logging in with Tor may appear to be coming from a different location entirely
• A user may be using more than once device to log in at the same time. Many people use mobile devices at the same time as their laptops, or have a work machine and a personal machine going to the same site

These are all true with IPv4 in which IP addressing is assigned according to the network segment you are on. Using IP address changes to detect fraud will result in too many false positives.

Note that with IPv6 the second half of the address is the MAC address of the device. As MAC addresses are (supposedly) unique it may be viable to do a fraud check when a new machine address is detected logging into an account. This is what companies like Facebook are already trying to do - detecting new systems rather than IPs logging in.