57 ms·
IP Spoofing
- happytrails 10y agoTime to spoof!
- lossolo 10y agoThere is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not originate from your network. It would make ddosers life harder.
- 0xdeadbeefbabe 10y agoI suspect there is some excuse.
- ryanlol 10y ago>There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. With what hardware?
- toomuchtodo 10y agoIf you're a transit provider, peering partner, or are an eyeball or content org with networking gear, this is trivial on your edge gear. There is no excuse except laziness for not doing do. https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38 (Note: This is from May 2000)
- criddell 10y agoI agree 100%. I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.
- lucb1e 10y agoMy ISP does that (XS4ALL, the Netherlands). Of course they can't know everything but if they receive abuse reports, notice your IP got blacklisted for spam or some honeypot network got a whiff of your IP address running malware variant XYZ, they put your IP address in quarantine (only 80 and 443 outgoing I think, or maybe only to the ISP's own website or something) and ask what's going on. I can tell you they're a real pain to convince to unblock you when you are 17 and have been a bad netizen. Which is a good thing.
- hueving 10y agoWhen it comes to ip spoofing based ddos attacks, the ISPs capable of tracking spoofed traffic on their network don't allow spoofed traffic. If they don't allow the spoofed traffic, you aren't participating in the DDoS.
- criddell 10y agoAbsolutely. No ISP should allow a packet with a spoofed IP leave it's network.
- marcosdumay 10y agoIt's about blocking non-spoofed attacks.
- Sanddancer 10y agoSupport costs for shutting down the average user are higher than the costs of bandwidth. Telling someone that their internet was shut off because their device was used in a botnet would lead to very long support calls and escalations.
- amluto 10y agoI used to have a regular retail network connection at the office (local DSL carrier, not some industrial-grade expensive fiber thing) that allowed spoofing. The office was multi-homed (we had a second connection from a different provider for redundancy -- it turns out that our major local incumbent provider had maybe one nine of availability), and the results were hilarious. It turns out that, because Linux considers IP addresses to belong to a computer and not to an interface, it's fairly easy to (mis-)configure things so that traffic with a source address belonging to one interface goes out the other interface. This, coupled with spoofing being allowed, meant that we sometimes accidentally spoofed ourselves, and it worked! We went for surprisingly long times without noticing that some of our TCP connections went out one pipe and back in the other. If I remember right, we would only notice it when we were confused by packet captures, when we had strange performance problems, or when we'd discover that we suddenly had two single points of failure. :)
- jacquesm 10y agoThat would penalize a whole pile of parties that probably have nothing whatsoever to do with the spoofers. It's akin to blackholing mail from yahoo.com because there are spammers on yahoo.com.
- deleted 10y ago[deleted]
- x1798DE 10y agoIsn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?
- jacquesm 10y agoNo, if you drop the BGP route the whole range disappears, not just the host that spoofs the IPs. So it kills off a whole pile of innocents as collateral damage.
- x1798DE 10y agoI don't know if I understand. At first I thought you meant that we shouldn't drop entire providers because one of their customers spoofed an IP, but of course the burden should be on those providers to make sure spoofed packets can't leave their network (since further up the chain you're getting packets that are originating from many networks). Are you talking about something else?
- niij 10y agoBGP route is on the receiving end.
- hueving 10y agoYou stop peering with providers originating spoofed traffic. The whole point is that you don't know which host is doing it (the IP is spoofed!). All you know is that a provider is allowing spoofed packets (with a probe from participating endpoints in a measuring service). That provider should be dropped and everyone on that provider should suffer collateral damage because that's the only way to economically incentivize them.
- rvern 10y agoThere is an excuse for not "securing" the network: disallowing spoofing is not desirable in the first place. There are legitimate uses to spoofing. What is not desirable is malware infecting user computers and using spoofing for DDoS attacks, but the ISP cannot know whether the packets were sent by malware or by a user. The proper way to solve the issue is to make secure systems that will not get infected easily by malware.
- packetized 10y agoWhy is disallowing spoofing not desirable in the first place? What legitimate uses to spoofing can you enumerate? Because I see none in your comment.
- illumin8 10y agoThis sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to them being smaller, regional ISPs without the expertise or staff to figure out how to do this. I hear you saying "just blackhole them until they figure it out," but it's not that easy. In many cases, the small regional ISP is the customer of a larger ISP, who is the customer of an even larger global ISP that you are connected to. You just see XXXgbps of traffic coming from your ISP, and have no idea which one (or more) of their customer's customer's are sending the traffic. This would be like saying "just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed?
- majke 10y agoYou use netflow to identify the offender of course!
- illumin8 10y agoLOL - there's a netflow and ipfix/ipfreely joke in there somewhere...
- lucb1e 10y ago> just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed? Sounds like a logic puzzle. I'm thinking a binary search would be the most efficient way.
- davedx 10y agoFantastic article.
- Thaxll 10y agoUDP spoofing is one thing but the latest and largest attacks are TCP based.
- majke 10y agoThis is a bold statement. First, one can spoof udp packets in the same way as tcp segments. Think syn or ack floods. Second the Krebs ddos is said to generate over 600 gigs of traffic but it was not necessarily with fully established tcp connections. It's unlikely it was with valid tcp connections. Let me give you a thought experiment: if you are flooded with 600 gigs of forged tcp packets, how do you know if the source ip's are spoofed or not? How do you know the ip in the src ip field belongs to the one that originated the packet?
- packetized 10y agoFlatly incorrect. The latest and largest attacks are generally UDP reflection attacks, with a smattering of TCP SYN flood & pure L7 attacks thrown in.
- dsp1234 10y agolatest and largest attacks Except for the latest and largest attacks: OVH @ near 1Tb/s in combined tcp_ack traffic on 2016/09/20 [0] When attackers have 150k+ comprimised hosts, with 1-30Mb/s each, there is no need for reflection/stealth/source spoofing/etc. At those levels, the attackers can just point them to an IP with 'normal' traffic and it's enough to be devastating. [0] - https://twitter.com/olesovhcom/status/778830571677978624 https://twitter.com/olesovhcom/status/778830571677978624
- packetized 10y agoApologies, I stand corrected.
- zmanian 10y agoNetflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1] [0] https://blog.torproject.org/blog/traffic-correlation-using-netflows https://blog.torproject.org/blog/traffic-correlation-using-n... [1] https://gitweb.torproject.org/torspec.git/tree/proposals/251-netflow-padding.txt https://gitweb.torproject.org/torspec.git/tree/proposals/251...
- mordocai 10y agoOf course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.
- dom0 10y ago> They see a lot of attack traffic from tor This was debunked.
- brainfire 10y agoWhere/how?
- mordocai 10y agoI don't believe this is actually arguable. People use tor to attempt to anonymize their (generally non-ddos) attacks. I don't believe tor can support the type of ddos the OP is talking about, of course. If you could provide the source of this debunk it'd be appreciated.
- ryanlol 10y agoThis is ridiculous. Anyone can grep their access logs for signs of obvious attacks and very quickly verify that very few, if any, of them originated from Tor exits.
- IgorPartola 10y agoI have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely new infrastructure we wanted to have replication from the old servers to the new. Instead of setting up some kind of higher level system, I wrote a tiny service in C which received the datagrams and then re-sent them to the new servers but spoofed the source IP so it matched the sensor. This worked incredibly well, and the tool was later used for various other purposes. Of course toward the end of it I learned that I could have done this all with iptables, but I like my way better because I got to learn a lot.
- hueving 10y agoUgh, if you're identifying sensors by IP instead of some other ID in the payload, you're doing it wrong. NAT between the sensors and you can throw a wrench into that whole scheme in a hurry. This is just a smell emanating from another poor design, not a justification for IP spoofing. If you want to spoof addresses, do it in the privacy of your own VPN tunnel between the servers. Don't expose that sickness to the Internet.
- IgorPartola 10y agoYou sir are quick to jump to very incorrect conclusions. It's a bad habit and you should abandon it at once. First, I never said we identified the sensors by IP, but it was important that we record the sensor's IP for diagnostic information. Second, IP spoofing was not done over the Internet, but rather only between our own servers inside our data center. Obviously doing this over the internet would not only be bad, but also highly unreliable. In conclusion... well I'm trying to be polite.
- hueving 10y agoIf you have anything, including diagnostic information, that depends on the source IP being correct, you're doing it wrong.
- 10y ago
- mrb 10y agoI will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers (http://blog.zorinaq.com/nginx-resolver-vulns/ http://blog.zorinaq.com/nginx-resolver-vulns/) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet. And yet https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php shows ~25% of network prefixes can be spoofed... sigh
- hueving 10y agoIt's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing capable, 100,000 node botnet (or the bitcoin required to rent on) with or without reflection capabilities is going to be able to saturate 40gb links. Name and shame ISPs that allow spoofing, stop wasting developers' time with this crap.
- majke 10y agoThis is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing. The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.
- silverwind 10y agoRecent HTTP DDoS attacks have shown that there is no dependency on spoofing. The problem will be there as long as there's insecure hardware out there.
- paulddraper 10y agoCurrently DDoS requires insecure hardware. If it didn't, we're one step closer to fixing it.
- complaint 10y agoThat was an excellent presentation, very informative. Except, why put that ridiculous meme in the middle of it? It's cringeworthy seeing an excellent technical presentation littered with such childish imagery. (Not that I agree with this bastardization of "meme" to mean "silly image with text overlaid in capital letters", but unfortunately that is what everyone is calling these things.)
- majke 10y agoTo wake up the audience and emphasize the message :) Also, to divide the presentation sharply between: problem statement and the solution.
- 0xcde4c3db 10y ago> (Not that I agree with this bastardization of "meme" to mean "silly image with text overlaid in capital letters", but unfortunately that is what everyone is calling these things.) The term for that is "image macro" [1]. An image macro represents a meme when the image is associated with a particular joke format, catch phrase, archetype, etc.. [1] https://en.wikipedia.org/wiki/Image_macro https://en.wikipedia.org/wiki/Image_macro
- AndyMcConachie 10y agoA couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care if some of their herd gets taken offline due to effective attribution. Amplification/reflection attacks which will still require IP spoofing. What I'm curious about, and only time will tell, is how much IP spoofing will continue to play a part in lsrge DDOS attacks? Why bother spoofing IPs if your botnet herd is already large enough to bring someone offline? 2) Go and download CAIDA's Spoofer application. Test it and give them bug reports. I gave them one a few weeks ago. https://www.caida.org/projects/spoofer/ https://www.caida.org/projects/spoofer/
- marcosdumay 10y agoYou answered your question there. Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry, and if the police were effective on this area, would be a huge boom to fighting those attacks.
- AndyMcConachie 10y agoI dunno. Spoofing for reflection/amplification is only going to work for certain services(e.g., DNS, NTPD). So perhaps if you don't spoof, but instead capture a large enough IoT botnet, you might be able to generate traffic that's harder to spot and segregate. I think we need to watch this space and see how things develop.
- mschuster91 10y ago> Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry In the days of Shodan, NO. Absolute no. 100/10 or 50/5 MBit/s household networking is becoming the norm in Germany, and other countries are way ahead of us Germans. Add in the fact that people with lots of (crappy) IoT devices are people who also have the money for high-speed internet connection... Then throw in a couple of stro's at DCs with good interconnections, and you got yourself a niiiiiiiice huge botnet. You can do LOTS of damage if you get maybe ten or twenty servers with 10 GBit/s links under your control! (10 servers = 100 GBit/s, 10% of the Krebs attack IIRC)
- lukasm 10y agohttps://www.youtube.com/watch?v=79u7bURE6Ss https://www.youtube.com/watch?v=79u7bURE6Ss youtube video
- tuxidomasx 10y agoSince IP spoofing could be done by a few malicious hosts, is it really accurate to consider a DoS via ip spoofing 'distributed'? Sure the source IPs may appear to come from all over, but that's just an illusion. When I think DDos, I envision thousands of compromised hosts all over the internet making requests to a target to consume resources.
- majke 10y agoIt's impossible to say if the attacker owns one beefy server or a thousand of bots.
- MOARDONGZPLZ 10y agoCan someone explain the consequences of DDoS attacks to me? My understanding is that the worst case is that the target server goes offline for the duration of the attack. If that's indeed the endgame, it seems like a lot of work on the attacker's part to disable a company's servers for a bit, but maybe I"m missing something? The article did mention servers boiling, but that was likely hyperbole unless there's a way to physically damage servers with DDoS.
- Z1nfandel 10y agoImagine you are a news outlet. You make money by creating articles that entice people to view your website. You make money to pay your expenses by having advertisements on your website. DDoS = No Website. No Website = no users viewing ads. No users viewing ads = No income. Yes, that typically resolves quickly. Depending on your hosting agreement, you may have to pay for all the excess bandwidth that the DDoS bots used. Now imagine if you are a bank, users want to be able to access their accounts/funds/etc. How long would you remain with your bank if you frequently couldn't access your information because they were being DDoS'd.
- devicenull 10y agoAnd, depending on your transit agreements you may have to pay for all that incoming bandwidth.
- alex- 10y agoYou are correct a DDoS (Distributed Denial Of Service) is intended to take a target off line or simply slow down the target significantly (ideally making the service useless) While it is very unlikely to cause hardware damage it can be extremely damaging to a company or service. Service outages undermine customer trust and could drive users to your competitors. A company might also have a service level agreement with large financial costs associated with a service being down. If you don't mind the service being down, then why have it? It going down will probably have some very negative effect.
- biot 10y ago"Operating a content neutral service in today's internet is a tough job. Some people dislike some websites, and they want to stop them from being available on the internet. The easiest way to do so is to launch a DDoS attack." ... which you can conveniently buy on one of the CloudFlare-protected DDoS service websites! I know this point has been hammered to death before, but I find it curious that despite their strong advocacy of being content neutral and not removing a site unless they receive a court order, their Terms of Service explicitly allows them to shut off service based solely on their opinion: "SECTION 11: INVESTIGATION CloudFlare reserves the right to investigate you, your business, and/or your owners, officers, directors, managers, and other principals, your sites, and the materials comprising the sites at any time. These investigations will be conducted solely for CloudFlare’s benefit, and not for your benefit or that of any third party. If the investigation reveals any information, act, or omission, which in CloudFlare’s sole opinion, constitutes a violation of any local, state, federal, or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service." Does CloudFlare ever make use of this provision?
- astrodust 10y agoThat's a standard clause you include in a contract to give you an out if things get so bad you have no choice but to cut the client loose. They're not offering a safe harbor, they're offering a non-discriminatory service. Those are two different things.
- grogenaut 10y agoWarning: Sales pitch masquerading as a technical talk.
- astrodust 10y agoWarning: Someone's cranky. It's a technical talk. It's much better to hear from people who are being attacked regularly and have a track record of dealing with it rather than those who have no clue.
- grogenaut 10y agosure except their paper just describes the issue and their solution is "pay us money". Not really up to the same standard as even a bad academic article, more like the paid talk track at a conference, you know, the kind lots of people avoid.
- astrodust 10y agoThey laid out several solutions, and none of them are specific to their platform. They also highlighted how the attacks are changing and if you're to effectively defend yourself you'll need to have more resources on hand. You can pay them, you can do it yourself, you can pay someone else, but at least you have options.
- nodesocket 10y agoThis is a great talk. Marek does an awesome job of explaining something that is very technical in a clear and casual manner. I definitely learned some new things. Video: https://www.youtube.com/watch?v=79u7bURE6Ss https://www.youtube.com/watch?v=79u7bURE6Ss
- nodesocket 10y agoI consider myself pretty technically savvy... Developer and DevOps. However, when I see tricks like in this talk using iptables with BPF bytecode[1] to block SYN packet floods, I get completely humbled. I know that I know nothing. [1] https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/strange-loop3-iwi-09-09.045.jpg https://idea.popcount.org/2016-09-20-strange-loop---ip-spoof...
- LyalinDotCom 10y agoI've been a software engineer for 18 years, but this amazing post reminded me how little I know about how the internet works lol. Going to read this a few times for sure!
- scurvy 10y agoLarge bandwidth attacks might look sexy, but they're trivially easy to block. Network operators care about pushing packets, not bits. The OVH attacks look huge to the average AWS user, (ZOMG a terabit!) but to even an average tier 2 transit provider it's a trivial attack to block. Especially when the attackers are hitting a single endpoint. To be honest, attackers are not very smart. They almost always use the same old attacks, attacks that are easily stoppable, and attacks against a single IP. 100gig coherent is easily turning volumetric attacks into old hat. Ending spoofed attacks today is a tactic that's 10 years too late.
- hueving 10y agoIt's not trivial by any means other than preventing it from clogging up internal stuff. If they are targeting a specific IP and the traffic is indistinguishable from normal traffic in the l3/l4 headers, there is no way you are going to block the attack without taking down the service. This is why solving spoofing is such an important problem. Once source IPs become sticky, we can actually block based on them to truly stop the attack without taking down the service.
- scurvy 10y agoYou block volumetric attacks by filtering the payload, not by blocking IP's. If you block by IP, you're going to have a lot of upset customers. Also, what are you going to do on an IPv6 attack? Block the entire /64? Unlikely. Also remember that a single IP doesn't always mean a single user for IPv4. An IP might represent several thousand customers in the case of NAT and especially CGNAT. If the traffic is indistinguishable from normal traffic via L3/L4, then it's a layer 7 attack, which cannot be spoofed. You're not dealing with spoofing in a L7 attack. The first D in DDoS stands for distributed. Even terabit sized attacks are easy to stop if they're sufficiently distributed (the attack is geographically dispersed enough to be diffused). It's when you get a terabit from a handful of AS's (like in S. Korean attacks) that you can feel pain. Even then, it usually only knocks out access in that part of the world, but not everyone. IP's will not be sticky. IPv6 is showing why it's important to not be sticky. Ending spoofing isn't going to stop DDoS attacks. I've got 10+ years of experience on the subject, and I'll gladly answer any questions you might have.
- bikamonki 10y agoAm I correctly understanding that big/most attacks are against unwanted content? For instance, in my country the two most popular political blogs that make strong opposition to the government are regularly DDOSed. If that is the case, maybe an easier solution would be to make this a software problem and not a network one. For that, I think we already have the tech to make P2P websites feasible. My phone and data plan cannot serve hundreds of requests per second but I'm sure I can get ALL the content I read on a given day from peers as well as pass it along to others. Clearly not a solution for all Internet use cases but a viable alternative to blogs.
- superkuh 10y agoAm I the only one that believes that the kind of non-preferential routing and anonymity that the current exchange setups provide is a benefit? In terms of society as a whole this far outweighs the downsides of DoS attacks using IP spoofing. "Solving" the "problem" of ip spoofing is only a benefit for centralized authorities and services. The loss of privacy is also serious. People advancing this idea are advancing it to better their commercial interests rather than the interests of individuals using the 'net.
- xorcist 10y agoIs that an actual use case? What could you possibly do without return traffic? Reverse Path Forwarding is best practice, and has been since more than a decade. The normal reason packets appearing on the wrong interface is a routing loop somewhere and this alone makes it worth it.
- superkuh 10y agoI'm not saying IP spoofing is useful for many real tasks. I'm saying the solution proposed in the article will end up being abused and worse than the problems it solves. It's one more step to an internet where commercial traffic is prioritized over actual users at all steps along the path.
- indolering 10y agoIf only we had a method for authenticating packets : /
- equalunique 10y agoThe slide showing the Internet Exchange's switch says those are Ethernet cables, but they're actually fiber. I'm really impressed with this presentation, but I wish that one flaw could be fixed.
- garaetjjte 10y agoIronically, Mobile IPv6 uses spoofing for route optimization.