4 ms·

If a bot is using its actual source address, you can block its IP at the edge (and even ask the ISP to investigate). Thanks to IP spoofing, that's totally inef

If a bot is using its actual source address, you can block its IP at the edge (and even ask the ISP to investigate). Thanks to IP spoofing, that's totally ineffective, so instead the only way to make the attack stop is to null route the host.

shaunol 10y ago
How does IP spoofing even work outside of those DNS reflection attacks mentioned on Krebs' blog? [1] > "many were garbage Web attack methods that require a legitimate connection between the attacking host and the target, including SYN, GET and POST floods." I constantly see references relating to DDoS attacks about how IP spoofing is such an obvious trick to use but I've never seen any way to actually do it. Why wouldn't every device on the internet spoof their IP? [1] https://web.archive.org/web/20160922021000/http://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos https://web.archive.org/web/20160922021000/http://krebsonsec...
- Jweb_Guru 10y ago
  > Why wouldn't every device on the internet just spoof their IP if it was this obvious thing? https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php - compromise a device in one of the ASes not marked "unspoofable." Those ASes do not consistently perform packet ingress filtering. That's not to say that DDOS attacks stop being possible, but at least they become traceable.
  - shaunol 10y ago
    I appreciate the response. I had no idea things were this bad.
  - x0 10y ago
    Thank you, I've actually been interested in the answer to this question for many years! Never was able to solve it via googling.
ghshephard 10y ago
What do you do when you have 10, 20, 50 million bots using their actual source address? Do you just block all 50 million devices? If so, then that would be a great way to initiate denial of service on those devices.
- kijin 10y ago
  Actually, that would be a good way to take all those insecure devices off the internet, or at least prompt someone to do something about it (even if temporarily, like hitting the "factory reset" button) before reconnecting them. Most countries don't allow cars on the road that are unsafe due to lack of maintenance. Perhaps it's time to do something similar for internet-enabled devices that cause serious harm to others. Hold the user, manufacturer, or network operator responsible for harm caused by their lack of maintenance.

shaunol 10y ago

How does IP spoofing even work outside of those DNS reflection attacks mentioned on Krebs' blog? [1] > "many were garbage Web attack methods that require a legitimate connection between the attacking host and the target, including SYN, GET and POST floods." I constantly see references relating to DDoS attacks about how IP spoofing is such an obvious trick to use but I've never seen any way to actually do it. Why wouldn't every device on the internet spoof their IP? [1] https://web.archive.org/web/20160922021000/http://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos https://web.archive.org/web/20160922021000/http://krebsonsec...

Jweb_Guru 10y ago
> Why wouldn't every device on the internet just spoof their IP if it was this obvious thing? https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php - compromise a device in one of the ASes not marked "unspoofable." Those ASes do not consistently perform packet ingress filtering. That's not to say that DDOS attacks stop being possible, but at least they become traceable.
- shaunol 10y ago
  I appreciate the response. I had no idea things were this bad.
- x0 10y ago
  Thank you, I've actually been interested in the answer to this question for many years! Never was able to solve it via googling.

ghshephard 10y ago

What do you do when you have 10, 20, 50 million bots using their actual source address? Do you just block all 50 million devices? If so, then that would be a great way to initiate denial of service on those devices.

kijin 10y ago
Actually, that would be a good way to take all those insecure devices off the internet, or at least prompt someone to do something about it (even if temporarily, like hitting the "factory reset" button) before reconnecting them. Most countries don't allow cars on the road that are unsafe due to lack of maintenance. Perhaps it's time to do something similar for internet-enabled devices that cause serious harm to others. Hold the user, manufacturer, or network operator responsible for harm caused by their lack of maintenance.