IP Spoofing

#1

Post by majke » Fri, Oct 07, 2016, 3:06 PM UTC

IP Spoofing
idea.popcount.org

Re: IP Spoofing

#2

Post by happytrails » Fri, Oct 07, 2016, 3:30 PM UTC

Time to spoof!

Re: IP Spoofing

#3

Post by lossolo » Fri, Oct 07, 2016, 3:53 PM UTC

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not originate from your network. It would make ddosers life harder.

Re: IP Spoofing

#4

Post by 0xdeadbeefbabe » Fri, Oct 07, 2016, 3:56 PM UTC

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

I suspect there is some excuse.

Re: IP Spoofing

#5

Post by davedx » Fri, Oct 07, 2016, 4:00 PM UTC

Fantastic article.

Re: IP Spoofing

#6

Post by ryanlol » Fri, Oct 07, 2016, 4:05 PM UTC

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

>There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce.

With what hardware?

Re: IP Spoofing

#7

Post by Thaxll » Fri, Oct 07, 2016, 4:05 PM UTC

UDP spoofing is one thing but the latest and largest attacks are TCP based.

Re: IP Spoofing

#8

Post by zmanian » Fri, Oct 07, 2016, 4:11 PM UTC

Netflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1]

[0] https://blog.torproject.org/blog/traffic-correlation-using-n...

[1] https://gitweb.torproject.org/torspec.git/tree/proposals/251...

Re: IP Spoofing

#9

Post by toomuchtodo » Fri, Oct 07, 2016, 4:22 PM UTC

ryanlol wrote: post #6

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

>There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. With what hardware?

If you're a transit provider, peering partner, or are an eyeball or content org with networking gear, this is trivial on your edge gear.

There is no excuse except laziness for not doing do.

https://tools.ietf.org/html/bcp38 (Note: This is from May 2000)

Re: IP Spoofing

#10

Post by criddell » Fri, Oct 07, 2016, 4:28 PM UTC

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

I agree 100%.

I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.