Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Spoofing

idea.popcount.org

Post reply on HN
Print view View original

31–40 of 136 posts

Re: IP Spoofing

#31

Post by hueving »

mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38.

Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing capable, 100,000 node botnet (or the bitcoin required to rent on) with or without reflection capabilities is going to be able to saturate 40gb links.

Name and shame ISPs that allow spoofing, stop wasting developers' time with this crap.

Re: IP Spoofing

#32

Post by packetized »

Thaxll wrote: post #7

UDP spoofing is one thing but the latest and largest attacks are TCP based.

Flatly incorrect. The latest and largest attacks are generally UDP reflection attacks, with a smattering of TCP SYN flood & pure L7 attacks thrown in.

Re: IP Spoofing

#33

Post by packetized »

rvern wrote: post #26
lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

There is an excuse for not "securing" the network: disallowing spoofing is not desirable in the first place. There are legitimate uses to spoofing. What is not desirable is malware infecting user computers and using spoofing for DDoS attacks, but the ISP cannot know whether the packets were sent by malware or by a user. The proper way to solve the issue is to make secure systems that will not get infected easily by m…

Why is disallowing spoofing not desirable in the first place? What legitimate uses to spoofing can you enumerate? Because I see none in your comment.

Re: IP Spoofing

#34

Post by majke »

hueving wrote: post #31
mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

This is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing.

The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.

Re: IP Spoofing

#35

Post by dsp1234 »

packetized wrote: post #32
Thaxll wrote: post #7

UDP spoofing is one thing but the latest and largest attacks are TCP based.

Flatly incorrect. The latest and largest attacks are generally UDP reflection attacks, with a smattering of TCP SYN flood & pure L7 attacks thrown in.

latest and largest attacks

Except for the latest and largest attacks: OVH @ near 1Tb/s in combined tcp_ack traffic on 2016/09/20 [0]

When attackers have 150k+ comprimised hosts, with 1-30Mb/s each, there is no need for reflection/stealth/source spoofing/etc. At those levels, the attackers can just point them to an IP with 'normal' traffic and it's enough to be devastating.

[0] - https://twitter.com/olesovhcom/status/778830571677978624

Re: IP Spoofing

#36

Post by hueving »

IgorPartola wrote: post #17

I have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely new infrastructure we wanted to have replication from the old servers to the new. Instead of setting up some kind of higher level system, I wrote a tiny service in C which received the datagrams and then re-sent them to the new servers but spoofed the source IP…

Ugh, if you're identifying sensors by IP instead of some other ID in the payload, you're doing it wrong. NAT between the sensors and you can throw a wrench into that whole scheme in a hurry.

This is just a smell emanating from another poor design, not a justification for IP spoofing. If you want to spoof addresses, do it in the privacy of your own VPN tunnel between the servers. Don't expose that sickness to the Internet.

Re: IP Spoofing

#37

Post by hueving »

illumin8 wrote: post #18
lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

This sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to them being smaller, regional ISPs without the expertise or staff to figure out how to do this. I hear you saying "just blackhole them until they figure it out," but it's not that easy. In many cases, the small regional ISP is the customer of a larger ISP, who is t…

Well you know the pee is coming from 1 of 3 (or maybe all 3) guys. You just threaten to kick them all out if they don't figure out which one is doing it.

This is a serious problem and it should be treated with serious consequences.

Re: IP Spoofing

#38

Post by hueving »

criddell wrote: post #10
lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

I agree 100%. I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.

When it comes to ip spoofing based ddos attacks, the ISPs capable of tracking spoofed traffic on their network don't allow spoofed traffic. If they don't allow the spoofed traffic, you aren't participating in the DDoS.

Re: IP Spoofing

#39

Post by IgorPartola »

hueving wrote: post #36
IgorPartola wrote: post #17

I have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely new infrastructure we wanted to have replication from the old servers to the new. Instead of setting up some kind of higher level system, I wrote a tiny service in C which received the datagrams and then re-sent them to the new servers but spoofed the source IP…

Ugh, if you're identifying sensors by IP instead of some other ID in the payload, you're doing it wrong. NAT between the sensors and you can throw a wrench into that whole scheme in a hurry. This is just a smell emanating from another poor design, not a justification for IP spoofing. If you want to spoof addresses, do it in the privacy of your own VPN tunnel between the servers. Don't expose that sickness to the Inte…

You sir are quick to jump to very incorrect conclusions. It's a bad habit and you should abandon it at once.

First, I never said we identified the sensors by IP, but it was important that we record the sensor's IP for diagnostic information.

Second, IP spoofing was not done over the Internet, but rather only between our own servers inside our data center. Obviously doing this over the internet would not only be bad, but also highly unreliable.

In conclusion... well I'm trying to be polite.

Re: IP Spoofing

#40

Post by erichocean »

hueving wrote: post #31
mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

> the crusade to end useful UDP protocols is successful

What? What crusade? I love UDP, use it every chance I get.

Who is "crusading" to end UDP on the Internet?

Post reply on HN