0

I have a public facing IP address setup at a VM in the Google Cloud Platform.

I am wondering, if it is possible as an outsider to take away this public IP, or pretend another computer is this public IP address.

Motivation is that my clients will not connect to my server but to them, man-in-the-middle attack.

0

1 Answer 1

0

Yes, IP hijacking attacks like you describe are possible, and have happened. See https://www.cloudflare.com/learning/security/glossary/bgp-hijacking/ for some interesting reading on one way that this can be done, by exploiting weaknesses in BGP.

Worse yet, the attacker may even be able to get valid certificate, signed by a well-trusted CA, for the domain from which the IP address was hijacked. If the attacker submits a CSR to a CA for the domain from which the IP address was hijacked, and uses a file-based Domain Control Validation method (like the one used by Let's Encrypt's automated ACME client) to prove control of the domain - then validation will succeed if the IP hijacking attack is successful, because the CA's HTTP request to fetch the validation file will be routed to the attacker's server where the attacker can host the validation file.

5
  • And how could I prevent those kind of attacks? Nov 27, 2022 at 19:02
  • @ChristophSanders The article that I linked above talks about prevention near the end. These types of attacks can be mitigated through monitoring, which GCP is presumably doing.
    – mti2935
    Nov 27, 2022 at 19:33
  • I would also like to add that the whole IPv4 address space can be scanned in minutes, which makes it impossible to hide your IP address. Nov 27, 2022 at 20:04
  • If you're concerned about this, then it's easy to setup your own monitoring. If you are running a web server at the IP address, just setup a client to do an https request to the server every minute or so. If the public key in the cert that the server presents is yours, and the client is able to complete a TLS handshake with the server, then it's your server, not an attacker's server. An attacker who hijacked your IP and is running a server on it would need your private key to complete the TLS handshake with your cert / public key.
    – mti2935
    Nov 27, 2022 at 22:48
  • 3
    BGP hijacking is an extreme edge case and is unlikely to be a risk for an individual person. Using BGP hijacking to take over someone's small VPS is like using a nuclear bomb to kill an annoying fly. From the fly's perspective, a nuke is just not a realistic threat, even if it can physically be used to kill it.
    – forest
    Nov 28, 2022 at 4:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .