14

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for each attempt. I assume it is the same person (bot) attempting to log in from the same geographical location.

How does the hacker manage to fake a different IP address? (Is he using an anonymity software like TOR?)

3
  • 10
    It could be much simpler than that. He could be using proxies to redirect the traffic through different countries/ISPs thus showing different ip addresses. The ip address is not fake, it's a real ip. It's just not his ip.
    – sir_k
    Dec 8 '14 at 10:58
  • @FlorinCoada to be fair, that's functionally quite similar to part of what Tor does.
    – David Z
    Dec 9 '14 at 5:32
  • Does your email provider support Two factor authentication? Setting up a phone number that receives a confirmation code will also hinder the attacker.
    – yesman
    Dec 9 '14 at 12:06
31

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.

3
  • 4
    Just a nit-picky note. If an attacker controlled your default network route, perhaps by taking over your router, then they could spoof addresses and make TCP connections. I once used a network stress tester from HP that did exactly this.
    – Zan Lynx
    Dec 8 '14 at 18:30
  • 2
    @ZanLynx If the attacker has that much control over your router, then they can probably do more sinister things than just spoofing IPs. Dec 9 '14 at 9:52
  • 1
    Doesn't need to be their own router -- theoretically, any router in between the target's computer and the address segment they're trying to spoof would suffice.
    – Shadur
    Nov 20 '15 at 10:33
9

"Analysis":

The fact that actual login attempts were made, tells you that the attacker was able to set up connections to the mail host .

Since, in order to receive information over the Internet, you must be in control of the IP address you are using, this cannot be a case of address spoofing. (Attackers may send you information using spoofed addresses, as mentioned by YaRi, but the responses would get routed away from the attacker. Hence no two-way communication would be possible.)


Conclusion:

This leaves you with two possibilities:

  1. The attacker uses some sort of redirection (proxying).
  2. Multiple attacks coincide.

1 is far more likely but 2 cannot be ruled ruled-out from the given information.

VPN, SOCKS or HTTP Proxies, Tor, or even botnets are nothing else than different kinds of proxying systems from a conceptual viewpoint. They operate on different layers of the Internet (VPN very low to overlay networks such as Tor very high) but all perform traffic forwarding in one way or the other.


Mitigation:

If you are in control of the mail server, you can look into blocking publicly known relays (e.g. the Tor exit nodes). A further option is to keep track of devices used to acces the mail server or the geolocation of the IP addresses, to require extended authentication when accessing with a new device or from a new location.

The above stated measures are probably not worth the effort unless you are running a somewhat larger service. The best measure otherwise, next to keeping the system updated, is to use a strong password.

6

It may be a Botnet with many different Computers in different countries.
It has the advantage (for the hacker) that it is almost impossible to block for you (or your mail provider) because there is no IP that can be blocked.

I don't know you, or your mail account, but if it is a normal account without important information in it there is a big chance that it is just a normal botnet trying to get access to as many accounts as possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.