Security against IP Spoofing

Question

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try to bring the services down and access the fake services. These ports adopt a blocking process of a connection request and record the IP and port of the client. These are logged and aren't granted access on service on port 80. But what to do if the client spoofs his IP? How can I modify my system?

Answer 1

I'm just going to answer (very) generally and let you do the math.

IP address spoofing works just like any other form of spoofing. Spoofing means pretending to be someone who you aren't. In the context of information security, IP address spoofing (henceforth refereed to simply as "spoofing") is quite common in many attacks. For example to target systems which utilize IP address as a security control such as router access control lists, firewalls, trust relationships, etc. Additionally it's very typically used in denial of service attacks. IP spoofing in practice can vary from mundane to highly complex. In general there are really 3 common ways to do it.

You could simply just set your IP address to anything you want using ifconfig in Unix or netsh in Windows. Additionally many tools come with built in spoofing capabilities such as decoys in Nmap or you can use various packet crafting tools such as Scapy. This is great and all, but anyone with basic networking knowledge will tell you that isn't going be really very useful in many cases. Sure spoofing datagram protocols like UDP or ICMP is trivial, but what about TCP? First of all most ISPs ignore the source address so sure you can start shooting out packets with any IP you like and they'll probably get delivered, but if you actually want to have any sort meaningful interaction (ie. pretty much anything other than DoS) you're out of luck because the response will obviously be send to whomever you happen to be spoofing. This is the nature of session-oriented protocols like TCP. The three-way handshake is going to spoil all of your fun. For example: You send your spoofed packets (SYN [A, ISNa]) over then that machine (B) which will respond (ACK [A, ISNa+X] SYN [B, ISNb]) to whomever you happen to be spoofing (A), but the only response machine B will get back from machine A is a reset (RST). Now if you're on the same LAN as the system you're spoofing, this works a little differently as you could just intercept the messages. To get around this little problem with TCP one could try to predict ISNs. For this reason initial sequence numbers (ISNs) in TCP are supposed to be hard to guess.

I was actually going to go on, but I'm not really good at this and I'm tired so I'm just gonna close up.. with a few words. Maybe I will come back and finish this up at a later time. Sorry.

The easiest way that I know of to do spoofing is via source routing. Just use loose source routing, put yourself in the path and you're good to go. The only dependency is that at least one network path between you and your target supports source routing. I don't think this is really much of an issue at this time.

Now to defend against spoofing what do you need to do? Keep your TCP/IP stack patched. Don't extend trust relationships outside of firewalls unless it's over an encrypted tunnel. Don't use IP addresses for authentication (yes, people do actually do this.) Use anti-spoof filters on routers and firewalls, either direct anti-spoof or reverse path forwarding checks. Don't allow source routed packets through network gateways and especially not internet gateways. (Some networking guys seem to have a hard-on for source routing on the internal network, but it's always worth a shot) In IOS this is as easy as changing one setting. It's called "no ip source-route". Additionally anti-spoof filters can be set to generate logs and you could use some fancy machine learning techniques to detect non expected source addresses on a given network.

Sorry to cut it short, but I'm out. Cherrio.

Answer 2

If the user spoofs his IP, he can't get a reply from your system, so that's not a vector to worry about. Spoofed IP's (if they even succeed) will only be a problem in terms of DoS attacks, not access.