97

Interesting problem. I wonder if a solution to this problem may be to force your users' web browsers to solve a cryptographic problem (using javascript running in their web browser) that is 'hard' to solve, but 'easy' for your site to verify. By 'hard' to solve, I mean a problem that would take ~10 seconds to solve with the resources of a typical desktop ...


84

You can change your IP to whatever you want; that's trivial. But that will not work the way you want to. Let's say the store's ISP is Apple Networks, and their IP range is 1.2.3.0 to 1.2.3.255. You note that and get home. Your home network is from Avocado Networks, and their IP range is 2.3.4.5. You change your IP to 1.2.3.123 and wait. Nothing happens. You ...


54

You don't have to worry about spoofing the IP from a different connection, because returned TCP packets would not make it to the attacker in that scenario. So all you have to worry about is how easy it is for the attacker to make use of that IP: Is that IP shared between multiple computers in the office? Can that IP be used on WiFi? How well is the ...


49

IP Spoofing is NOT IP Hijacking which is causing confusion for anyone reading this. IP Spoofing at its minimum / bare bones explanation is also called impersonation. Let's have an ASCII look at what it does, and how it happens: You (1.2.3.4) --> connect to your bank --> Bank (2.2.2.2) In spoofing, I can pretend to be anyone I want, if I am on your ...


34

How? Rented botnet and captcha farms. Why? Someone wants your data. It's cheaper to steal it than buy it. What to do? Stealing it is cheaper, but not free. It costs "them" (whoever ultimately wants the data, not the botnet or captcha farm) money to do these attacks. Make it more expensive to attack you than the data is worth. Identify patterns to ...


31

TOR, VPN, bots, proxies, you name it.. The source IP is not "spoofed" per se... it's the real deal. If someone really spoofed a source IP, they couldn't establish a TCP connection or receive any replies. The source IP spoofing method is more useful over UDP when launching an amplification attack to a victim/spoofed IP.


22

Short answer: no. Longer answer: yes, if you control a router device close to the target device (it has to be on the path between the the real source IP address and the target, and on the path between the faked IP address and the target) or if the target network/host accepts source-routed packets.


22

You are doing CAPTCHA wrong. The idea of CAPTCHA is to make it hard (read "next to impossible) for a computer to solve it, but easy for a human to do so. If you just use one static image, asking to type in 4 for instance, then a computer will have no trouble to repeatedly enter 4 when instructed to do so. Instead, consider using reCAPTCHA or similar ...


19

Short answer: Yes, but not as possible as it used to be, and dependent upon how literally one takes your question. Long answer: I notice that you did not ask "Is it possible to carry on a TCP conversation with a spoofed IP address" - that question was ably answered by @symcbean. You specifically asked "Is it possible to pass TCP handshake with spoofed IP ...


18

Full IP spoofing is hard for the commoners. Everything in IP is made of packets. Each packet has a source address and a destination address. IP spoofing is about sending packets with a wrong source address. Sending such a packet is simple enough with a few lines of code (it tends to require local Administrator / root rights; on Linux, this is a matter of a ...


18

While I am sure there are, in fact, firewalls that may do that, I am not off-hand aware of any that operate this way. There are packet spoofing detection mechanisms, although they tend to act a little different. Bogon Filters A bogon is defined as bogus IP address. Specifically, it is the list of all IP addresses that have not been allocated by IANA, by a ...


17

IP spoofing means creating IP packets with a source address which is not yours and sending those to some destination. To be able to do so, routers on the path have to allow traffic coming from an incorrect source. BCP38 describes a number of techniques (filtering, uRPF) which ISP's can use to prevent spoofed IP traffic originating from their network. Since ...


17

As others pointed out, IP spoofing alone is not a problem here since the threeway handshake for TCP will not complete. BGP hijacking combined with IP spoofing could result into a somewhat theoretical attack here if you're using public addresses in your access-list. In that case the attacker would spoof the IP-address in the access-list so traffic is coming ...


15

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this ...


14

Your question seems to indicates you do not understand how IP works, how IP routing works and how TCP is implemented on top of it (and incidentally, what IP address spoofing really means) Routing IP implements a routed datagram protocol: each datagram (packet) has (among other things) a source address, a destination address and a payload (there are many ...


14

Is it possible to spoof the IP once a TCP handshake was performed successfully? No. A TCP session is defined by four items: Source IP address Source IP port Destination IP address Destination port This comes from RFC 793: To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port identifier to ...


14

If you can put up a simple "type the number in this picture" CAPTCHA and have that stick for 24 hours, you know your enemy is an amateur. You know this sort of primitive device involving bespoke code will slow them down for 24 hours. This could be fun :) I would make extensive use of stylesheets to hide information in the page code: in two senses,...


13

You can spoof your IP to whatever you want it to be. Pick a number, any number! However, you can't use it to trick a HTTP server into believing your are someone you are not. The TCP handshake protects against IP spoofing. So no luck there. Anyways, my guess is that the webpage that is shown on the devices isn't discriminating based on IP. Sounds more ...


12

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001. UPDATE Cloudflare blog entry about DNS Amplification DDoS, and follow-up ...


12

Defining a spoofed packet First off, there's the concept of ownership of an IP range. I'll say anything that isn't coming from the registered owner or delegate of an IP block from IANA (and the subsidiaries, and the delegating ISPs) is a spoof. It's all about routing There are a few things to consider when talking about spoofing. The first is that you can ...


12

Why? Data related to phone numbers, names and email addresses are extremely valuable, both in the legal and underground market. How? It sounds like someone is using a botnet to mine data from you. This could mean connections from a few dozen globally scattered IPs to thousands of them. Personally I have no idea how they are getting around reCapchas, other ...


11

A spoofed packet is a packet with a fake source IP address. To detect an incoming packet as spoofed, firewalls try to apply "local rules": they reject the packet if its coming from a link which is nominally incompatible with the alleged source address. For instance, if a firewall is between an internal network, with a known IP range, and the wide Internet, ...


11

Short Answer Assuming a TCP connection, it is nearly impossible to spoof a source IP address without control of the network. Longer Answer Assuming you are not using any proxies (which can cause issues if you're getting their IP address from a X-FORWARDED-FOR header), and running a service on TCP, it's extremely difficult to spoof a source IP address To ...


11

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. Apart from that using any kind of proxy means that nmap communicates with the IP stack of the proxy and not of the target. This means: ICMP ping can not be done to ...


10

This code allows an attacker who knows the victim's X-Forwarded-For: header and the victim's session ID to login as that user. If the victim doesn't have an X-Forwarded-For: header, the attacker can put the victim's IP address in his header and the code will use that value as his legitimate IP address instead of his actual IP address. This is the ...


10

I'd say IP spoofing is pretty much on the table here. Nothing stops people which have access to the datacenter infrastructure (e.g. employees) to forge IP packets with the password-free address, and capture the reply by altering the router configuration, or connecting to the right spot and listening in promiscuous mode. The OP is effectively giving access ...


10

There are types of DDOS attacks which don't use source spoofing and where thus BCP38 does not help. For example the current IoT based DDOS attacks against Dyn, OVH, etc did not use source spoofing at all. Also, DDOS by employing the Slashdot Effect does not make use of spoofed addresses either. Spoofed addresses are instead mainly used in amplification ...


9

Its impossible to spoof your ip address of a TCP connection due to the 3 way handshake.... Unless of course the application is vulnerable to CWE-291: Trusting a Self Reported IP address Sure enough in ./wordfence/lib/wfUtils.php on line 77: public static function getIP(){ $IP = 0; if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){ $IP = $_SERVER[...


9

I'd say you're right! They don't seem to have kept in mind that the HTTP header X-FORWARDED-FOR might return '; DROP TABLE users;--. They suggest this in order to also lock sessions for people behind proxies, and name Tor as example. This is sort of stupid; Tor never forwards the original IP for obvious reasons. Moreover, it doesn't (shouldn't?) even look ...


9

TCP sequence prediction was a hot topic around 2001, but most vendors have patched their OS quite quickly around that time. See this CERT advisory from September 2001, which includes statements from various vendors. Basically, if the TCP sequence prediction attack works against a system, then that system was not updated with security fixes from more than a ...


Only top voted, non community-wiki answers of a minimum length are eligible