IP Spoofing • Hacker News Board

Re: IP Spoofing

#91

Post by Sanddancer » Sat, Oct 08, 2016, 3:56 AM UTC

hueving wrote: post #31

mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

The problem needs fixed from both ends. Developers that write and maintain programs with bad defaults should be named and shamed as well. Their software has a security flaw that allows these problems to be exploited. Back in the 90s, the default configuration for most mail servers was to allow relaying from all and sundry, until the spam problem made people realize that an open relay was a bad thing that would be abused by malicious actors. Saying developers' time shouldn't be "wasted" on this is like saying automakers' time shouldn't be wasted on airbags and people should just drive better.

Re: IP Spoofing

#92

Post by Sanddancer » Sat, Oct 08, 2016, 4:19 AM UTC

criddell wrote: post #10

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

I agree 100%. I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.

Support costs for shutting down the average user are higher than the costs of bandwidth. Telling someone that their internet was shut off because their device was used in a botnet would lead to very long support calls and escalations.

Re: IP Spoofing

#93

Post by spc476 » Sat, Oct 08, 2016, 4:43 AM UTC

IgorPartola wrote: post #17

I have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely new infrastructure we wanted to have replication from the old servers to the new. Instead of setting up some kind of higher level system, I wrote a tiny service in C which received the datagrams and then re-sent them to the new servers but spoofed the source IP…

There are valid reasons to spoof IP addresses (we do that at work in production). It's only bad if the spoofing "leaks" out to the Internet at large (at work, we know which machines are doing the spoofing, and it's a limited number of spoofed addresses, all directed towards own own equipment).

Re: IP Spoofing

#94

Post by bikamonki » Sat, Oct 08, 2016, 5:31 AM UTC

Am I correctly understanding that big/most attacks are against unwanted content? For instance, in my country the two most popular political blogs that make strong opposition to the government are regularly DDOSed. If that is the case, maybe an easier solution would be to make this a software problem and not a network one. For that, I think we already have the tech to make P2P websites feasible. My phone and data plan cannot serve hundreds of requests per second but I'm sure I can get ALL the content I read on a given day from peers as well as pass it along to others. Clearly not a solution for all Internet use cases but a viable alternative to blogs.

Re: IP Spoofing

#95

Post by laxk » Sat, Oct 08, 2016, 6:41 AM UTC

AndyMcConachie wrote: post #43

A couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care…

If every upstream providers will have the netflow protocol in that case they can just drop bad traffic on the specific interface and they also can trace a source of bad traffic and drop it as early as possible.

Re: IP Spoofing

#96

Post by superkuh » Sat, Oct 08, 2016, 7:23 AM UTC

Am I the only one that believes that the kind of non-preferential routing and anonymity that the current exchange setups provide is a benefit? In terms of society as a whole this far outweighs the downsides of DoS attacks using IP spoofing.

"Solving" the "problem" of ip spoofing is only a benefit for centralized authorities and services. The loss of privacy is also serious. People advancing this idea are advancing it to better their commercial interests rather than the interests of individuals using the 'net.

Re: IP Spoofing

#97

Post by xorcist » Sat, Oct 08, 2016, 7:59 AM UTC

superkuh wrote: post #96

Am I the only one that believes that the kind of non-preferential routing and anonymity that the current exchange setups provide is a benefit? In terms of society as a whole this far outweighs the downsides of DoS attacks using IP spoofing. "Solving" the "problem" of ip spoofing is only a benefit for centralized authorities and services. The loss of privacy is also serious. People advancing this idea are advancing it…

Is that an actual use case? What could you possibly do without return traffic?

Reverse Path Forwarding is best practice, and has been since more than a decade. The normal reason packets appearing on the wrong interface is a routing loop somewhere and this alone makes it worth it.

Re: IP Spoofing

#98

Post by Confusion » Sat, Oct 08, 2016, 8:15 AM UTC

zAy0LfpBZLC8mAC wrote: post #85

hueving wrote: post #71

Earlier quoted context omitted.

Services used in amplification attacks are victims because their services are being DoS'ed as well and their IPs are the ones that end up on flowspec block lists. They are also victims from the second order effects of idiots in prominent places claiming that their services are the source of the Internet's woes (e.g. Cloudflare's ridiculing of dns resolver operators). Your entire second point is nonsensical because th…

I agree that vilifying UDP doesn't really help anyone, but that's kindof besides the point. Victim blaming is wrong because you divorce someone's intentional decision to cause harm from their responsibility for the resulting harm. To take the classical example: It's not inherently wrong to tell people that they should avoid situations that empirically have an increased risk of being raped. It's only wrong if you then…

  Implementing BCP 38 is additional work that's only required [..]

That's like saying that the fact that I need to lock my door makes me a 'victim' of the existence of thieves, because otherwise I wouldn't need locks. That's not how the word 'victim' is used, either in general or in this particular context. Insisting on some extremely literal interpretation on the word 'victim' is entirely unhelpful here.

Re: IP Spoofing

#99

Post by superkuh » Sat, Oct 08, 2016, 8:16 AM UTC

xorcist wrote: post #97

superkuh wrote: post #96

Am I the only one that believes that the kind of non-preferential routing and anonymity that the current exchange setups provide is a benefit? In terms of society as a whole this far outweighs the downsides of DoS attacks using IP spoofing. "Solving" the "problem" of ip spoofing is only a benefit for centralized authorities and services. The loss of privacy is also serious. People advancing this idea are advancing it…

Is that an actual use case? What could you possibly do without return traffic? Reverse Path Forwarding is best practice, and has been since more than a decade. The normal reason packets appearing on the wrong interface is a routing loop somewhere and this alone makes it worth it.

I'm not saying IP spoofing is useful for many real tasks. I'm saying the solution proposed in the article will end up being abused and worse than the problems it solves. It's one more step to an internet where commercial traffic is prioritized over actual users at all steps along the path.

Re: IP Spoofing

#100

Post by lucb1e » Sat, Oct 08, 2016, 8:20 AM UTC

niij wrote: post #86

lucb1e wrote: post #29

Earlier quoted context omitted.

> just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed? Sounds like a logic puzzle. I'm thinking a binary search would be the most efficient way.

I think K-means would work best-- whichever cluster is closest to the "hot zone" gets the boot. :P

How do you measure a hot zone, sensors at the bottom of the pool? Or at middle-depth but along the edges?