2

Since it is possible to fake the source IP of a packet, is it also possible to anonymize DDOS attacks?

  • Nope. A layer 7 DOS is gonna get bottle-necked by whatever proxy you use to spoof your IP. Layer 4 is still OK though... – KnightOfNi Jan 28 '14 at 2:41
  • There's a really good defcon video about this somewhere on youtube... it doesn't go into really specific stuff, but it answers your question. Unfortunately, I lost the link, but if you search for "DEFCON DOS" you're probably going to find it. – KnightOfNi Jan 28 '14 at 2:51
  • 1
    Have a Google for DNS amplification – symcbean Feb 11 '14 at 22:48
5

The other answers seemed wrong to me, so here is my attempt.

Yes.

This is very common, and has recently seem attacks in the rage of hundreds of gigabits per second. The idea is not to spoof your IP to the target machine, but to spoof your IP to an intermediary that returns data back to your spoofed IP (target).

It is generally not very easy to spoof source IP addresses, so having a direct distributed DOS against a target (i.e: SYN Flood) using all fake addresses would be very difficult. If you are able to spoof a few addresses, you would have the best luck abusing a service that would result in an amplification (DNS, NTP). So the purpose of spoofing the address here is not to hide your IP, but to make the intermediate think you are the victim, flooding them with unsolicited responses.

The attack would go something like this:

  • The attacker spoofs the victims IP address, and sends a 60 Byte DNS request to an open resolver.
  • The resolver responds to the victim's IP, a 4000 byte TXT record

Here is some more info on recent attacks:

https://www.watchguard.com/infocenter/editorial/41649.asp

http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack

  • Why would spoofing your IP be tough? It's only tough to get the response back because you would need to be on the same network and listening via promiscuous/monitor mode. Since SYN cookies would basically thwart any attempt to do a SYN flood (as you would not be able to send the third portion of the TCP handshake) without creating the actual connection and keeping it alive, you would need access to the actual host of the IPs which you want to establish connections from to the target. But if they were not guarding against this, then it should (at least in theory) be fairly trivial. – Adam Thompson Nov 15 '17 at 21:15
  • The above answer does not really apply to TCP. – David Houde Dec 10 '17 at 13:43
3

The first D in DDOS means distributed.
All the attractiveness of distributed DOS is that it comes from so many actors that your are unable to correctly identifies the responsible.
Why would you bother with spoofing an IP.
Also most of the DDOS these days are run by botnets and those attacks are made againt the will of infected victims.
Spoofing an IP is nothing relevant in this case.

1

A DDoS attack is usually just a lot of packets going from many IP's to one target IP address. Assuming ISP's would allow this (having source addresses that's not on their range), you could have several packets "reach" the target though. This may limit you to SYN packets, ICMP requests, etc...

But, knowing that a DDoS is distributed, you'd need to feed many machines the possibility to spoof addresses. If you want to bring a target to its knees, it may be more useful to send a heavy HTTP GET request (a search query, for example), rather than just a TCP SYN packet. For this, spoofing will be a challenge; since you won't be able to complete the TCP 3-way handshake.

-1

You could send a request to a large list of websites. If you spoofed your IP address as the target IP address, then all of the websites' responses would go to the target IP address, potentially creating a DDoS. It would be distributed, because lots of servers are all sending the response.

  • 3
    Well, HTTP requests are done over TCP, which means you need to complete a handshake before getting HTTP responses. The TCP ACK response isn't very efficient for DDoS. – Benoit Esnard Jan 17 '16 at 15:46
  • reflection is also covered by David Houde's answer – schroeder Jan 17 '16 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.