0

I know just enough about TCP to know there's a header which, among other things, contains the origin IP and target IP of that packet, which the internet uses to guide it to its destination and then on its return journey (the response).

If I wanted to make an illegal online transaction, could I write the origin IP header to point to some other person's computer, perhaps one I've compromised, then gather the data from that computer later and delete the traces, leading any investigators to the wrong PC and a dead end (once they try to prosecute the wrong person and realize they were tricked)?

This seems like an interesting and simple alternative to running the packets through a series of proxy servers and encrypting the TCP headers via a network such as Tor (which the FBI has allegedly developed a way to compromise). Is this a common / well-known strategy? If so, what are the flaws?

|improve this question
  • To clarify: the TCP header is IP address agnostic; it doesn't know anything about addressing nor does it care. This is handled by IP at the network later. So if you are talking about address spoofing, that is something at the network layer, not the transport layer. – multithr3at3d Apr 28 '16 at 17:11
1

While this is a good idea in theory it can not work practically.
The TCP protocol uses a three-way-handshake, and so when you spoof the origin IP in a packet the packet with the SYN flag (First packet) will be sent but when the destination machine tries to establish a connection by sending an SYN-ACK packet back to that spoofed IP, the connection will fall since the spoofed machine will deny sending the first packet.

P.s: Some routers will not allow the sending of a packet not from the routers IP and drop it already by them and may even notify the ISP...

|improve this answer
  • Some routers block spoofed addresses - but not many – paj28 Apr 28 '16 at 12:48
  • I know. That is exactly why I wrote "some". – Bubble Hacker Apr 28 '16 at 12:54
  • Got ya! Nice answer, and welcome to the site :) – paj28 Apr 28 '16 at 19:12
0

Let's assume you just ask out of curiosity and we are not helping you committing a crime.

So why would you want to modify the TCP Header and redirect packets to another host? I am not sure if that could work at all but if you had a compromised computer, why don't you do whatever you have in mind from there?

Also if the compromised computer is offline it won't receive the packets at all but you won't know until you go and check.

If you ask just for the general feasibility, maybe someone esle can give you a definite answer.

|improve this answer
  • 2
    On this site, you can always assume an understanding is wanted for the sake of preventing a crime, or purely for knowledge. Often the best way is to imagine you're the bad guys. – Viziionary Apr 28 '16 at 12:15
  • 1
    I am new to this very site but I am aware of what you say. My introducing line should be more of a joke. But thank you for clarifying. ;) – Thorian Apr 28 '16 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.