IP Spoofing • Hacker News Board

Re: IP Spoofing

#121

Post by Twirrim » Sat, Oct 08, 2016, 7:58 PM UTC

loulouxiv wrote: post #82

Twirrim wrote: post #28

Earlier quoted context omitted.

What legitimate purpose is there for spoofing your IP address?

I think there are probably many of them but they are hard to think of because they would relate to unusual situations. There at least one very nice that I know : if you are hosting something (eg a webserver) behind a connection with limited upload capabilities like a consumer grade DSL, you can very easily aggregate multiple uploads links with nothing more than a bit of iptable magic. It would be completely transpare…

These are still likely to be IP addresses in an IP range the ISP is responsible for routing. This is the big need. ISPs need to stop packets on egress that are from IP addresses not in the ISPs network. There's no excuse for it and it would drastically undermine a sizeable number of DDoS attacks (not every DDoS, because they don't all require IP spoofing.)

Unfortunately this requires ISPs to actually be responsible for the data coming out of their network, including DDoS traffic. Once you stop the spoofing, ISPs and transit providers will soon figure out which ASs are problems and start blocking them etc.

Re: IP Spoofing

#122

Post by hueving » Sat, Oct 08, 2016, 8:07 PM UTC

scurvy wrote: post #118

hueving wrote: post #106

Earlier quoted context omitted.

It's not trivial by any means other than preventing it from clogging up internal stuff. If they are targeting a specific IP and the traffic is indistinguishable from normal traffic in the l3/l4 headers, there is no way you are going to block the attack without taking down the service. This is why solving spoofing is such an important problem. Once source IPs become sticky, we can actually block based on them to truly…

You block volumetric attacks by filtering the payload, not by blocking IP's. If you block by IP, you're going to have a lot of upset customers. Also, what are you going to do on an IPv6 attack? Block the entire /64? Unlikely. Also remember that a single IP doesn't always mean a single user for IPv4. An IP might represent several thousand customers in the case of NAT and especially CGNAT. If the traffic is indistingui…

Yes, you block by IP and piss off customers or the whole /64 if necessary. IPs will almost always be sticky to the advertised prefix.

A TCP SYN, or any UDP initial request indistinguishable from legit traffic of the same protocol at L3/L4, and both can be spoofed so I don't know where you got the idea that they cant be spoofed and are L7 only.

If you're "stopping the attack" through dispersion, you're not actually stopping it, you're just paying the price of absorbing it. I know this is common practice, but it's pathetic than an arms race is the state of the art in defense. It concentrates power into orgs like cloudflare, akamai, and Google (project shield) because the only way to participate is to use them.

Re: IP Spoofing

#123

Post by hueving » Sat, Oct 08, 2016, 8:13 PM UTC

collinmanderson wrote: post #112

erichocean wrote: post #40

Earlier quoted context omitted.

> the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?

It's fine to have a public UDP server on the internet. Just make sure it can't be used to amplify/mirror attacks. QUIC uses tokens for example. https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblH...

That's not even enough. The token generation can be used as an amplification vector.

That's why this approach of attacking UDP instead of spoofing is misguided.

Re: IP Spoofing

#124

Post by hueving » Sat, Oct 08, 2016, 8:21 PM UTC

dogma1138 wrote: post #109

hueving wrote: post #102

Earlier quoted context omitted.

Once spoofing is solved, you have attribution. Once you have attribution, you can use blacklists, notify ISPs, etc. Cleaning up or isolating infected machines becomes tractable at that point.

Blacklists and attribution do not hold that much value. Blacklists are only useful to stop only a few DDoS attacks mainly amplified ones like the ones that abuse open DNS resolvers which should be cleaned up on their own, in which case you want to be blacklisting the resolvers not the machines that use IP spoofing since they do not attack you directly. Many (heck most) DDoS attacks do not use IP spoofing, the recent…

>Blacklists and attribution do not hold that much value

Only because spoofing prevents them from being reliable in any way.

>in which case you want to be blacklisting the resolvers

This approach is idiotic and its the reason these attacks are still a problem. EVERY DNS SERVER can be used if it resolves anything, not just if it's an open resolver. So your blacklist would have to include the root name servers, the .com names servers, etc.

>if you aren't amplifying your attack using UDP protocols you will usually not going to be using IP spoofing in the first place

Completely false. SYN floods and non amplified UDP floods very frequently spoof because it makes pruning attacks upstream by source impossible.

I'm not sure where you got this information, but stop spreading it. It's protecting incompetent network operators, harassing service operators, and doing little to improve the security of the Internet.

Re: IP Spoofing

#125

Post by hueving » Sat, Oct 08, 2016, 8:25 PM UTC

fanf2 wrote: post #108

hueving wrote: post #101

Earlier quoted context omitted.

No, this is a completely false equivalence (the spam comparison). An open relay is the equivalent to ISPs allowing people to put whatever IP they want in the header. People are operating completely sane services and anti-UDP warriors suggesting they change them because they appeared in a ddos is idiotic and harmful to the Internet. You can completely eliminate all UDP services and the untraceable DDoS problem won't g…

DNS servers have in fact been modified to make it much harder to use them in amplification attacks, by adding response rate limiting - see http://www.redbarn.org/dns/ratelimits

That does much less than you would think. Attackers just spread the packets out over more DNS servers and still get the same amplification factor.

See why trying to 'fix' this at the DNS level is stupid?

Re: IP Spoofing

#126

Post by [deleted] » Sat, Oct 08, 2016, 8:51 PM UTC

hueving wrote: post #31

mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

[deleted]

Re: IP Spoofing

#127

Post by ryanlol » Sat, Oct 08, 2016, 8:52 PM UTC

hueving wrote: post #31

mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

> Someone with a spoofing capable, 100,000 node botnet

Does not exist and if it did, it's the unspoofed traffic you should be worried about.

Re: IP Spoofing

#128

Post by user5994461 » Sat, Oct 08, 2016, 9:54 PM UTC

mschuster91 wrote: post #59

marcosdumay wrote: post #46

Earlier quoted context omitted.

You answered your question there. Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry, and if the police were effective on this area, would be a huge boom to fighting those attacks.

> Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry In the days of Shodan, NO. Absolute no. 100/10 or 50/5 MBit/s household networking is becoming the norm in Germany, and other countries are way ahead of us Germans. Add in the fact that people with lots of (crappy) IoT devices are people who also have the money for high-speed internet connection... Then thr…

800/500 Mbits/s on speedtest here. (less if we pick a server on another continent).

Fiber is coming to the household. It's gonna bring the potential for DDoS to another order of magnitude. :D

Well. The IoT device will be limited by the bad Wifi or 100 Mbps Ethernet. Hopefully.

Re: IP Spoofing

#129

Post by astrodust » Sun, Oct 09, 2016, 2:20 AM UTC

grogenaut wrote: post #69

Warning: Sales pitch masquerading as a technical talk.

Warning: Someone's cranky.

It's a technical talk. It's much better to hear from people who are being attacked regularly and have a track record of dealing with it rather than those who have no clue.

Re: IP Spoofing

#130

Post by astrodust » Sun, Oct 09, 2016, 2:23 AM UTC

biot wrote: post #63

"Operating a content neutral service in today's internet is a tough job. Some people dislike some websites, and they want to stop them from being available on the internet. The easiest way to do so is to launch a DDoS attack." ... which you can conveniently buy on one of the CloudFlare-protected DDoS service websites! I know this point has been hammered to death before, but I find it curious that despite their strong…

That's a standard clause you include in a contract to give you an out if things get so bad you have no choice but to cut the client loose.

They're not offering a safe harbor, they're offering a non-discriminatory service. Those are two different things.