1

I am currently reading literature that states that Bogons are commonly used by attackers when conducting DDos attacks. I did some searching for an explanation and all I could find was that "Bogons make it difficult to trace back to the attackers IP"

My question is, if an attacker is free to choose an IP to spoof, why not use a random non-Bogon not owned by the attacker? What is the advantage of the Bogon over a non-Bogon?

3
  • Here are some nice responses ipregistry.co/blog/bogons
    – camp0
    Sep 3, 2021 at 10:38
  • 2
    But it just says "because they cannot be traced back to an existing host or source". The question is, why would an attacker care that its a Bogon or non-Bogon? All they would care about is that it was not their own IP
    – rlon134
    Sep 3, 2021 at 10:45
  • 1
    Depends on how is configure their ISP, some ISP blocks spoof ips, others not, others dont allow bogon IPs, so probably depends on if the attacker can reach the destination with regular spoof ips, or bogon if there are miss configurations on their ISP
    – camp0
    Sep 3, 2021 at 11:02

1 Answer 1

3

The conclusion that attackers prefer bogons as spoofed source IP addresses is a product of selection bias and mistaking correlation for causation.

Which of these is higher?

  1. The probability that any randomly chosen packet with a non-bogon source address is associated with malicious traffic; or
  2. The probability that any randomly chosen packet with a bogon source address is associated with malicious traffic.

The answer, of course, is the latter. Invalid IP addresses are inherently not the source of much (if any) legitimate traffic. However, the reason for this isn't that attackers prefer bogon addresses for spoofing, it's that almost no legitimate traffic comes from bogon addresses.

When attackers send DDoS traffic, they often generate the spoofed source IP at random. They do not include logic that excludes bogon ranges or RFC1918 addresses. As such, a reasonable portion of the outgoing packets' source addresses will be bogons.

Now put yourself in the shoes of a sysadmin looking at their traffic logs. Approximately 15% of addresses in the space 0.0.0.0 to 255.255.255.255 are bogons. Let's assume that an attacker has sent one million malicious packets to your network. That means that 850k of those packets came from non-bogon IPs, and 150k came from bogon IPs. However, at the same time as the attack was happening, normal traffic from every day operations was still flowing through the network, so those 850k packets might make up 50% of your network load. As such, if you look at the percentages, 50% of non-bogon traffic was malicious, but nearly 100% of bogon traffic was malicious! That must mean that attackers prefer bogon addresses!

But, if you consider the ratio of non-bogon source addresses to bogon source addresses in the malicious traffic alone, only 15% of the malicious packets actually came from bogon addresses, which leads to the exact opposite conclusion.

This reasoning problem is amplified by the fact that it's far more difficult to tell if a given packet is malicious if it has a legitimate-looking source address. This means that the number of malicious packets with non-bogon addresses that we can easily identify as malicious is lower than the actual number of malicious packets with non-bogon addresses. This further skews analysis.

Logically, it also makes no sense for an attacker to prefer bogon IP addresses over non-bogon IPs. At best it does nothing, because the router isn't looking at the source IP address. At worst, it makes the packets more likely to get dropped by a router instead of reaching the target.

1
  • 1
    Fantastic, thank you, makes perfect sense now.
    – rlon134
    Sep 9, 2021 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.