Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/
"The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not"
From what I know, IP spoofing only allows one-way communication, as server replies the spoofed address, and therefore its attack is limited. Isn't that right?
I suspect they are oversimplifying. You're correct in that generally two way communication with a spoofed IP address is not possible. There were tcp sequencing attacks but they have not been practically possible for years.
However, there are so many other ways to hide your IP address, e.g., tor, pivoting off compromised hosts, using a VPN that won't keep logs, free WiFi, etc..
It's probably just easier for them just to say spoofed than to enumerate all the ways you can mask your address.
Yes two way communication is not possible with a spoofed IP, and so hackers usually try other ways of masking their IP, like using VPNs and Tor
However, some attacks do not require any reply from the server so they are possible to carry out with a spoofed IP. The simplest example of this would be a DDoS, where the bots in a botnet could spoof their IP to bypass IP blacklisting (and perhaps also conceal their origin).
Generally, vulnerabilities that can be exploited over UDP would not require any reply from the server so IP spoofing may be used. For example, CVE-2002-0649, which the SQL Slammer worm employed, could be exploited with a single UDP packet and no reply was required from the server. Theoretically, an attacker could use such a vulnerability with a spoofed IP to achieve remote code execution. Of course, this assumes that the attacker already knows if and where such a vulnerability exists in the target.
