97

Interesting problem. I wonder if a solution to this problem may be to force your users' web browsers to solve a cryptographic problem (using javascript running in their web browser) that is 'hard' to solve, but 'easy' for your site to verify. By 'hard' to solve, I mean a problem that would take ~10 seconds to solve with the resources of a typical desktop ...


82

You can change your IP to whatever you want; that's trivial. But that will not work the way you want to. Let's say the store's ISP is Apple Networks, and their IP range is 1.2.3.0 to 1.2.3.255. You note that and get home. Your home network is from Avocado Networks, and their IP range is 2.3.4.5. You change your IP to 1.2.3.123 and wait. Nothing happens. You ...


54

You don't have to worry about spoofing the IP from a different connection, because returned TCP packets would not make it to the attacker in that scenario. So all you have to worry about is how easy it is for the attacker to make use of that IP: Is that IP shared between multiple computers in the office? Can that IP be used on WiFi? How well is the ...


48

IP Spoofing is NOT IP Hijacking which is causing confusion for anyone reading this. IP Spoofing at its minimum / bare bones explanation is also called impersonation. Let's have an ASCII look at what it does, and how it happens: You (1.2.3.4) --> connect to your bank --> Bank (2.2.2.2) In spoofing, I can pretend to be anyone I want, if I am on your ...


34

How? Rented botnet and captcha farms. Why? Someone wants your data. It's cheaper to steal it than buy it. What to do? Stealing it is cheaper, but not free. It costs "them" (whoever ultimately wants the data, not the botnet or captcha farm) money to do these attacks. Make it more expensive to attack you than the data is worth. Identify patterns to ...


31

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


23

Yes (with your assumptions of neglecting the client being able to intercept the return of the handshake at a spoofed IP) if you do things correctly. HTTP requests are done over TCP; until the handshake is completed the web server doesn't start processing the HTTP request. Granted a random user could attempt to spoof the end of a handshake; but as they have ...


22

You are doing CAPTCHA wrong. The idea of CAPTCHA is to make it hard (read "next to impossible) for a computer to solve it, but easy for a human to do so. If you just use one static image, asking to type in 4 for instance, then a computer will have no trouble to repeatedly enter 4 when instructed to do so. Instead, consider using reCAPTCHA or similar ...


21

Short answer: no. Longer answer: yes, if you control a router device close to the target device (it has to be on the path between the the real source IP address and the target, and on the path between the faked IP address and the target) or if the target network/host accepts source-routed packets.


19

When you send a request to the server, the server need to know where to answer, it's with your ip address. This is directly based on the TCP/IP protocol and in a lower level than web servers. For the reason why Firebug doesn't show your IP address, it's like when you receive mail (paper), you have your address written in front, and the sender in the back. ...


19

Set up a web server and send them a link to something on it. Once they click the link, their IP address will be logged in your web server's access logs. You could also host an image on said web server and trick a user into loading it through a third party's website. Some social networking sites allow you to upload snippets of HTML including image tags. ...


18

While I am sure there are, in fact, firewalls that may do that, I am not off-hand aware of any that operate this way. There are packet spoofing detection mechanisms, although they tend to act a little different. Bogon Filters A bogon is defined as bogus IP address. Specifically, it is the list of all IP addresses that have not been allocated by IANA, by a ...


18

Short answer: Yes, but not as possible as it used to be, and dependent upon how literally one takes your question. Long answer: I notice that you did not ask "Is it possible to carry on a TCP conversation with a spoofed IP address" - that question was ably answered by @symcbean. You specifically asked "Is it possible to pass TCP handshake with spoofed IP ...


17

Full IP spoofing is hard for the commoners. Everything in IP is made of packets. Each packet has a source address and a destination address. IP spoofing is about sending packets with a wrong source address. Sending such a packet is simple enough with a few lines of code (it tends to require local Administrator / root rights; on Linux, this is a matter of a ...


17

As others pointed out, IP spoofing alone is not a problem here since the threeway handshake for TCP will not complete. BGP hijacking combined with IP spoofing could result into a somewhat theoretical attack here if you're using public addresses in your access-list. In that case the attacker would spoof the IP-address in the access-list so traffic is coming ...


16

IP spoofing means creating IP packets with a source address which is not yours and sending those to some destination. To be able to do so, routers on the path have to allow traffic coming from an incorrect source. BCP38 describes a number of techniques (filtering, uRPF) which ISP's can use to prevent spoofed IP traffic originating from their network. Since ...


15

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this ...


14

Your question seems to indicates you do not understand how IP works, how IP routing works and how TCP is implemented on top of it (and incidentally, what IP address spoofing really means) Routing IP implements a routed datagram protocol: each datagram (packet) has (among other things) a source address, a destination address and a payload (there are many ...


14

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port identifier to ...


14

If you can put up a simple "type the number in this picture" CAPTCHA and have that stick for 24 hours, you know your enemy is an amateur. You know this sort of primitive device involving bespoke code will slow them down for 24 hours. This could be fun :) I would make extensive use of stylesheets to hide information in the page code: in two senses, first ...


13

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead. for If you generate the page dynamically to contain an image located at a domain that you control, e.g. <img src="http://123123.deanonymize.mydomain.com"/> the ...


13

You can spoof your IP to whatever you want it to be. Pick a number, any number! However, you can't use it to trick a HTTP server into believing your are someone you are not. The TCP handshake protects against IP spoofing. So no luck there. Anyways, my guess is that the webpage that is shown on the devices isn't discriminating based on IP. Sounds more ...


12

In general yes, there is ways of doing this, as a quick google search would've been able to tell you. When ever you call, write or send a file to a person on skype you make direct contact with the persons IP/ISP IP, and that you are of course able to track. A simple way to do it in windows is using netstat -n while in a call, and look for the port you know ...


12

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001. UPDATE Cloudflare blog entry about DNS Amplification DDoS, and follow-up ...


12

Defining a spoofed packet First off, there's the concept of ownership of an IP range. I'll say anything that isn't coming from the registered owner or delegate of an IP block from IANA (and the subsidiaries, and the delegating ISPs) is a spoof. It's all about routing There are a few things to consider when talking about spoofing. The first is that you can ...


12

Why? Data related to phone numbers, names and email addresses are extremely valuable, both in the legal and underground market. How? It sounds like someone is using a botnet to mine data from you. This could mean connections from a few dozen globally scattered IPs to thousands of them. Personally I have no idea how they are getting around reCapchas, other ...


11

Essentially it depends on the attacker and what resources they have available. Ordinary home-users or attackers who aren't very dedicated might be deterred by source IP address blocking, but more advanced/determined attackers have a number of ways to get round this. The obvious one is to use one of the wide range of proxy services available on the Internet....


11

A spoofed packet is a packet with a fake source IP address. To detect an incoming packet as spoofed, firewalls try to apply "local rules": they reject the packet if its coming from a link which is nominally incompatible with the alleged source address. For instance, if a firewall is between an internal network, with a known IP range, and the wide Internet, ...


11

Short Answer Assuming a TCP connection, it is nearly impossible to spoof a source IP address without control of the network. Longer Answer Assuming you are not using any proxies (which can cause issues if you're getting their IP address from a X-FORWARDED-FOR header), and running a service on TCP, it's extremely difficult to spoof a source IP address ...


11

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done to ...


Only top voted, non community-wiki answers of a minimum length are eligible