Since it is possible to fake the source IP of a packet, is it also possible to anonymize DDOS attacks?
The other answers seemed wrong to me, so here is my attempt.
This is very common, and has recently seem attacks in the rage of hundreds of gigabits per second. The idea is not to spoof your IP to the target machine, but to spoof your IP to an intermediary that returns data back to your spoofed IP (target).
It is generally not very easy to spoof source IP addresses, so having a direct distributed DOS against a target (i.e: SYN Flood) using all fake addresses would be very difficult. If you are able to spoof a few addresses, you would have the best luck abusing a service that would result in an amplification (DNS, NTP). So the purpose of spoofing the address here is not to hide your IP, but to make the intermediate think you are the victim, flooding them with unsolicited responses.
The attack would go something like this:
- The attacker spoofs the victims IP address, and sends a 60 Byte DNS request to an open resolver.
- The resolver responds to the victim's IP, a 4000 byte TXT record
Here is some more info on recent attacks:
DDOS means distributed.
All the attractiveness of distributed DOS is that it comes from so many actors that your are unable to correctly identifies the responsible.
Why would you bother with spoofing an IP.
Also most of the DDOS these days are run by botnets and those attacks are made againt the will of infected victims.
Spoofing an IP is nothing relevant in this case.
A DDoS attack is usually just a lot of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc...
But, knowing that a DDoS is distributed, you'd need to feed many machines the possibility to spoof addresses. If you want to bring a target to its knees, it may be more useful to send a heavy HTTP GET request (a search query, for example), rather than just a TCP SYN packet. For this, spoofing will be a challenge; since you won't be able to complete the TCP 3-way handshake.
You could send a request to a large list of websites. If you spoofed your IP address as the target IP address, then all of the websites' responses would go to the target IP address, potentially creating a DDoS. It would be distributed, because lots of servers are all sending the response.