1

I just learned about IP spoofing and so I set up VMs and sent spoofed UDP packets (8.8.8.8, Facebook's IP, Twitter's IP) to myself (home PC and mobile) from well-reputed VPS providers like AWS, Softlayer, Intellectica Systems, etc. and I was able to receive them.

I am a novice to networking, but isn't this dangerous? Shouldn't these providers have taken measures to stop this? I would like to know why these well-known providers have allowed this. I mean isn't it a firewall problem and network problem?

  • 1
    I'm not sure we can tell you why a company has decided to do or not do something. Maybe the protections kick in after more than just address spoofing? Maybe there's also a count or bandwidth threshold? – schroeder Nov 29 '17 at 10:11
  • What schroeder said, but I do think that a lot of ISP's do not allowed spoofed IP headers. So in an internet world scenario with most ISP's you would not actually be able to spoof anything. – Wealot Nov 29 '17 at 12:33
  • He transmitted over the internet, I think. – Adonalsium Nov 29 '17 at 21:27
  • @Wealot, I also thought IP spoofing will not be possible in reputed ISP ie reputed VPS provided. But the reality is something else.... – Al-Alamin Nov 30 '17 at 4:12
  • 1
    Blocking IP spoofing is very heavy handed and also very hard to nail down. Depending on what stage the packet is at (and what protocol) the ISP might not even know where the packet came from other than where it claims to be from. – Sirens Nov 30 '17 at 5:52
1

The reason why spoofing is allowed may lie in thresholds and risk-based security.

Thresholds because single occurrences do not always imply incidents. A certain amount of packets of some kind are required to cause meaningful damage (e.g. DDoS). Flooding spoofed packets may trigger an action.

Risk because all good security is based on risk versus cost. If a VPS service earns more money (in customers and purchases) and/or saves more money (in staff, equipment and licences) by keeping a feature open than they lose (in bad reputation and responding to incidents), they will probably maintain the feature regardless of ethics and best practices.

Lastly, there may be some legitimate use cases for spoofing though none come to mind right now... Anyone?

  • 1
    Only if the service provider is a tier 2 or peering transit for someone else, but that's a massive stretch of the imagination - VPS providers are usually the bottom feeders of the Internet transit. Your point in terms of "reducing risk through inaction" is on the money, the more technical reason is that source filtering takes a toll on the equipment (access lists are risky, and adds load on routers/firewalls, plus reduce operational efficiency - what if you want to add a new network segment, then you probably need to add it to your source filters). Security is hard work! Few can be bothered. – Milen Apr 8 '18 at 18:47
1

Allowing the source IP address to be set to anything is actually how things are supposed to be set up. When you have a home computer that is connected two different ISPs, it usually doesn't work without networking hacks because the ISPs block source IP addresses that don't belong to their respective networks. The computer is supposed to be able send packets out though either ISP, and load balance all outgoing packets across both ISPs. Even without having a proper multi homed network with a dedicated IP address range that's part of the global IP routing table, you should still be able to load balance outgoing packets across multiple ISPs, if they didn't block it. So there are legitimate uses for allowing any source IP address to be set.

In a rented server environment, you're locked in to their network so there isn't as much use for this, but I imagine that there are network testing situations and network tunneling applications where changing the source address is still useful.

What those companies may actually be doing is monitoring for changed source IP addresses rather than blocking them. If your VPS is sending out spoofed IP packets, they'll be notified and they'll investigate your VPS for spam. It's actually a really good system!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.