IP Spoofing in DoS and Distributed DoS

• IP spoofing occurs when a hacker inside or outside a network impersonates the conversations of a trusted computer.

• IP spoofing can use either a trusted IP address in the network or a trusted external IP address.

• Uses for IP spoofing include:

- Injecting malicious data or commands into an existing data stream

- Diverting all network packets to the hacker who can then reply as a trusted user by changing the routing tables

• IP spoofing may only be one step in a larger attack.

Routers determine the best route between distant computers by examining the destination address. The originating address is ignored by routers. However, the destination machine uses the originating address when it responds back to the source. In a spoofing attack, the intruder sends messages to a computer indicating that the message has come from a trusted system. For example, an attacker outside your network pretends to be a trusted computer, either by using an IP address that is within the range of IP addresses for your network, or by using an authorized external IP address that your network trusts and provides specified resource access to. To be successful, the intruder must first determine the IP address of a trusted system, and then modify the packet headers so that it appears that the packets are coming from the trusted system. The goal of the attack is to establish a connection that allows the attacker to gain root access to the host and to create a backdoor entry path into the target system.

Normally, an IP spoofing attack is limited to the injection of data or commands into an existing stream of data passed between a client and server application or a peer-to-peer network connection. To enable bidirectional communication, the attacker must change all routing tables to point to the spoofed IP address. Another approach the attacker could take is to simply not worry about receiving any response from the applications. For example, if an attacker is attempting to get a system to mail a sensitive file, application responses are unimportant.

If an attacker manages to change the routing tables to divert network packets to the spoofed IP address, the attacker can receive all network packets that are addressed to the spoofed address and reply just as any trusted user. Like packet sniffers, IP spoofing is not restricted to people who are external to the network.

5-28 Implementing Secure Converged Wide Area Networks (ISCW) v1.0 © 2006 Cisco Systems, Inc.

IP spoofing can also provide access to user accounts and passwords, or it can be used in other ways. For example, an attacker can emulate one of your internal users in ways that prove embarrassing for your organization. The attacker could send e-mail messages to business partners that appear to have originated from someone within your organization. Such attacks are easier when an attacker has a user account and password, but they are also possible when simple spoofing attacks are combined with knowledge of messaging protocols.

Distributed DoS attacks are often carried out using a spoofed source IP address.

© 2006 Cisco Systems, Inc. Cisco Device Hardening 5-29

Continue reading here: Worm Virus and Trojan Horse Attacks and Mitigation

Was this article helpful?

0 0