Basics - IP spoofing

Question

I can't understand why IP spoofing (even basic) is very limited.

Suppose Bob and Alice are about to communicate and Eve can see network communication, why eve can't use IP spoofing for making "Man In The Middle" ? I know there is a TCP issue with predictable stats (ACK, sequence), but if these informations are not encrypted and can be intercepted, Eve can see theses infos and so, spoofing is possible.

In the same idea, I can't understand why, on a local network (no DHCP), if I set an IP adress already used by another one, messages won't come back to me (ARP cache ?). I am not talking only about spoofing, but suppose I set the same IP adress as the victim, how routers can decide which is the "good" one ?

Except using cryptography, how to guarantee the IP I am communicating with ?

Answer 1

If you are directly on the path of the information, then there is absolutely nothing preventing you from pretending you are that IP address. If you were the first device along the network that Alice talked with, you could absolutely convince her that you are Bob's IP.

This is a big part of why browsers require signed certificates in order to trust SSL based sites. Without that trusted signed certificate, there is no way to be certain that the server is who they say they are.

As for simply being on the same network, the problem is routers. When you connect to a network, routers need to be informed of what your IP address is so they know in which direction to route those packets. These are formed in to routing tables. Since each IP only has a single record, if another computer claims to be that IP after the first is established, the router simply ignores it as an error and continues routing the way it was going.

You could potentially run in to weird situations where different routers think different network interfaces are the proper IP and based on which direction packets get routed, they could end up in two different places.

Additionally, if you were on an unswitched network that only utilizes hubs (or say, a wireless network with a common key), then it would in fact be possible to intercept traffic bound for another IP address. You wouldn't be able to prevent the other computer from also getting the messages in those cases, so it would be difficult to inject anything for any protocol with a sequence number, but you'd be able to fully monitor it or spoof it entirely if the system wasn't expecting a connection.

In short, the primary problem comes down to the route the data takes. Most modern networks are smart enough to avoid sending data places it doesn't need to go (as this is inefficient). If the network is broadcasting data everywhere, then it becomes far easier, but still with some challenges if you need to prevent the real client from knowing about the tampering (unless you can fully act as gate keeper between them and the rest of the network.)

Answer 2

Imagine the scenario using physical letters, as it's easier to picture.

Say I send a letter with a return address that doesn't correspond with my actual house (or somewhere I can collect mail). What will happen to the letter? As long as the send address is correct, the mail service will deliver this letter to the correct person. However, when they want to send a return letter, they send it to the address I wrote on the envelope. Now, the mail service has no way of knowing that actually my address is different from the address written on the envelope, so they deliver it to the address specified on the envelope. I now have no way of receiving that return letter, as it's at a different location.

For your second part, If I actually changed the address of my house, then I would start receiving letters sent to that address. However, no two people can have the same address, because then the mail service couldn't uniquely identify houses and therefore deliver mail.

This is an analogy, but plays pretty close to the true picture. On the internet, packets go through several devices (called 'hops') before reaching their destination. Each hop will forward packets to the IP address in the header, without any thought to where it 'should' be going. So, if you spoof your IP address, it will be sent, but you won't get any response. As for setting the same IP address as a victim, you will simply get a conflict. The router will likely kick either both or the last to connect off the network and not allow you to join with the same address. It makes no logical sense to have duplicate addresses on the network, and there's no way the router can legitimately handle this scenario.

Answer 3

So non-encrypted communication can be subject to Man in the Middle, the randomization of sequence numbers which I believe you are referencing is for thwarting data injections, that is someone could just send a packet into the stream and it can be accepted if the sequence number is known. For instance, a firewall may keep track of a tcp session to allow communication back into the network, if an attacker could guess the sequence then there is a possibility to get the packets into the network from a rogue device even if the firewall restricts based on source since the source address can be spoofed.

The idea you may have however is that in a switched environment unicast packets are not supposed to go over all ports, so you would have to turn the switch into a hub, which would probably be noticed, and if the admin was security conscious they may have already restricted the ports to not allow this.

The other question is due to ARP, ARP tables typically refresh every 5 minutes, so if your machine comes on and arps that it's MAC has this IP then it will be placed in the ARP table, then it usually waits 5 minutes and does the same to refresh the cache or any packets sent will update the arp cache. If the other device refresh cycle occurs right after your refresh cycle or it is constantly sending out packets then you will see a little communication then it will drop. There are functions in routers to help thwart duplicate IP's but a lot of it is done on the client itself, the client will see there is a duplicate and disable it's interface. If I were to guess on the router deciding on which IP is accurate I would suspect it uses age. This is assuming the ARP table is not manually configured.

One way you can ensure you are talking to the right machine in clear text on the same broadcast network, is to use the arp command and make sure the MAC matches the machine, of course it is fairly trivial to duplicate a MAC as well so none of this is 100% which is why encryption and signing was created.

Hope that helps