IP Spoofing
By: Serafin Sanchez 3/23/08
Bad guys have long employed the tactic of masking their true identity, from disguises to aliases to caller-id blocking. It should come as no surprise then, that bad guys who conduct their activities on networks and computers should employ such techniques. IP spoofing is one of the most common forms of on-line camouflage. In IP spoofing, an attacker gains unauthorized access to a computer or a network by making it appear that a malicious message has come from a trusted machine by spoofing the IP address of that machine. In this blog, we will examine the concepts of IP spoofing: why it is possible, how it works, what it is used for and how to defend against it.
IP spoofing works with the basic protocol for sending data over the Internet and many other computer networks is the Internet Protocol (IP). The header of each IP packet contains, among other things, the numerical source and destination address of the packet. The source address is normally the address that the packet was sent from. By forging the header so it contains a different address, an attacker can make it appear that the packet was sent by a different machine. The machine that receives spoofed packets will send response back to the forged source address, which means that this technique is mainly used when the attacker does not care about response or the attacker has some way of guessing the response.
There are a few variations on the types of attacks that successfully employ IP spoofing. Although some are relatively dated, others are very pertinent to current security concerns.
Non-Blind
Spoofing - this type of attack takes place when the attacker is on the
same subnet as the victim. The sequence and acknowledgement numbers can be sniffed,
eliminating the potential difficulty of calculating them accurately. The
biggest threat of spoofing in this instance would be session hijacking. This is
accomplished by corrupting the data stream of an established connection, then
re-establishing it based on correct sequence and acknowledgement numbers with
the attack machine. Using this technique, an attacker could effectively bypass
any authentication measures taken place to build the connection.
Blind
Spoofing - this is a more sophisticated attack, because the sequence and
acknowledgement numbers are unreachable. In order to circumvent this, several
packets are sent to the target machine in order to sample sequence numbers.
While not the case today, machines in the past used basic techniques for generating
sequence numbers. It was relatively easy to discover the exact formula by
studying packets and TCP sessions. Most operating systems implement random
sequence number generation making it difficult to predict them accurately. If,
however, the sequence number was compromised, data could be sent to the target.
Several years ago, many machines used host-based authentication services. A
properly crafted attack could add the requisite data to a system enabling full
access for the attacker who was impersonating a trusted host.
Man In
the Middle Attack - both types of spoofing are forms of a common
security violation known as a man in the middle (MITM) attack. In these
attacks, a malicious party intercepts a legitimate communication between two
friendly parties. The malicious host then controls the flow of communication
and can eliminate or alter the information sent by one of the original
participants without the knowledge of either the original sender or the
recipient. In this way, an attacker can fool a victim into disclosing
confidential information by spoofing the identity of the original sender, who
is presumably trusted by the recipient.
Denial
of Service Attack - IP spoofing is almost always used in what is
currently one of the most difficult attacks to defend against – denial of
service attacks, or DoS. Since crackers are concerned only with consuming
bandwidth and resources, they need not worry about properly completing
handshakes and transactions. Rather, they wish to flood the victim with as many
packets as possible in a short amount of time. In order to prolong the
effectiveness of the attack, they spoof source IP addresses to make tracing and
stopping the DoS as difficult as possible. When multiple compromised hosts are
participating in the attack, all sending spoofed traffic; it is very
challenging to quickly block traffic.
The misconceptions of IP Spoofing, while some of the attacks described above are a bit outdated, such as session hijacking for host-based authentication services, IP spoofing is still prevalent in network scanning and probes, as well as denial of service floods. However, the technique does not allow for anonymous Internet access, which is a common misconception for those unfamiliar with the practice. Any sort of spoofing beyond simple floods is relatively advanced and used in very specific instances such as evasion and connection hijacking.
Defending Against Spoofing - there are a few precautions that can be taken to limit IP spoofing risks on your network, such as:
Filtering
at the Router - Implementing ingress and egress filtering on your border
routers is a great place to start your spoofing defense. You will need to
implement an ACL (access control list) that blocks private IP addresses on your
downstream interface. Additionally, this interface should not accept addresses
with your internal range as the source, as this is a common spoofing technique
used to circumvent firewalls. On the upstream interface, you should restrict
source addresses outside of your valid range, which will prevent someone on
your network from sending spoofed traffic to the Internet.
Encryption
and Authentication - Implementing encryption and authentication will
also reduce spoofing threats. Both of these features are included in Ipv6,
which will eliminate current spoofing threats. Additionally, you should
eliminate all host-based authentication measures, which are sometimes common
for machines on the same subnet. Ensure that the proper authentication measures
are in place and carried out over a secure encrypted channel.
In conclusion, IP Spoofing is a problem without an easy solution, since it’s inherent to the design of the TCP/IP suite. Understanding how and why spoofing attacks are used, combined with a few simple prevention methods, can help protect your network from these malicious cloaking and cracking techniques.