1

I have seen from: http://www.scientificamerican.com/article/tracking-cyber-hackers/

"The source field can be changed [spoofed] by an attacker to make it seem like it's coming from someplace it's not"

From what I know, IP spoofing only allows one-way communication, as server replies the spoofed address, and therefore its attack is limited. Isn't that right?

2 Answers 2

3

I suspect they are oversimplifying. You're correct in that generally two way communication with a spoofed IP address is not possible. There were tcp sequencing attacks but they have not been practically possible for years.

However, there are so many other ways to hide your IP address, e.g., tor, pivoting off compromised hosts, using a VPN that won't keep logs, free WiFi, etc..

It's probably just easier for them just to say spoofed than to enumerate all the ways you can mask your address.

2
  • +1 for free WiFi... sometimes people think too hard about the software options out there.
    – KnightOfNi
    Jul 1, 2014 at 23:43
  • 1
    @KnightOfNi I think people don't generally reference free Wi-Fi because it doesn't actually provide anonymity the way the other ways do. I know of at least a few stories where the police tracked the IP down to a cafe and then just checked the CCTV footage to find who was using it consistently during that time.
    – trallgorm
    Jul 10, 2020 at 14:56
1

Yes two way communication is not possible with a spoofed IP, and so hackers usually try other ways of masking their IP, like using VPNs and Tor

However, some attacks do not require any reply from the server so they are possible to carry out with a spoofed IP. The simplest example of this would be a DDoS, where the bots in a botnet could spoof their IP to bypass IP blacklisting (and perhaps also conceal their origin).

Generally, vulnerabilities that can be exploited over UDP would not require any reply from the server so IP spoofing may be used. For example, CVE-2002-0649, which the SQL Slammer worm employed, could be exploited with a single UDP packet and no reply was required from the server. Theoretically, an attacker could use such a vulnerability with a spoofed IP to achieve remote code execution. Of course, this assumes that the attacker already knows if and where such a vulnerability exists in the target.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .