3 ms·
It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-in
by thaumaturgy 15y ago
It "attacks back" in this case by redirecting users to various other sites. The fun thing about applications like this one is that they make for a great self-inflicting DoS; all I have to do, as an attacker, is run a script that launches lame attacks with spoofed IPs against a fusker site. With not too much trouble, I could cause your website to redirect a lot of your U.S. customers to goatse, or whatever module you decide to use.
Hate to be a killjoy, but things like this are usually not a good idea. Unfortunately, somebody has to rediscover that every six months or so.
edit: nevermind, I was going off of hilariously out-of-date information. TCP ISNs haven't been easy to predict in -- gulp -- about a decade. Damn, now I feel old.
- threepointone 15y agoFair enough, 'attacking back' might be a bit of overkill, but you can't deny the utility of a pluggable module that spots possible attacks (as connectjs middleware, for instance). What I got out of this is a simple way to implement some form of protection on my site.
- mike-cardwell 15y agoYou'd have to have a high level of control of the network that the server lives on in order to do this sort of spoofing of tcp connections for arbitrary IP addresses. And if you had that level of control anyway, you wouldn't need to spoof attacks against the server, you could just redirect all incoming requests to a different server which returns whatever HTTP response headers or bodies that you want. So your described attack is highly unlikely to ever happen.
- FooBarWidget 15y ago> is run a script that launches lame attacks with spoofed IPs against a fusker site How do you spoof your IP in TCP? If you spoof your source address you shouldn't be able to get past the handshake.
- jgrahamc 15y agohttp://en.wikipedia.org/wiki/TCP_sequence_prediction_attack http://en.wikipedia.org/wiki/TCP_sequence_prediction_attack You spoof the IP address you are sending from and then predict the TCP sequence number so you can make it look as though you are receiving the replies (even though they are going to another machine since you spoofed the IP address). Such an attack was proposed by Hacker News' very own rtm: http://tools.ietf.org/html/rfc1948 http://tools.ietf.org/html/rfc1948
- thaumaturgy 15y agoUnfortunately for my original point, it looks like my info was waaaay out of date, and most OSs started using cryptographically random ISNs years ago. My bad, sorry for the noise. edit: I suppose this means it's time for me to finally discard my copy of Inside TCP/IP, third edition. :-(
- khafra 15y agoDon't just throw it away; it's great for ergonomics. Most people's monitors are way too far below eye level.
- xorglorb 15y agoI'm not an expert, but HTTP travels over TCP and, if I remember correctly, TCP uses sequence numbers to prevent IP spoofing.
- iliis 15y agoGood point. Altough a funny tought to see some company redirect it's customers to goatse. I think, a more realistic approach for example would be a ssh honeypot like kippo (https://code.google.com/p/kippo/ https://code.google.com/p/kippo/).
- deleted 15y ago[deleted]
- younewman 15y agoExcept then you could use your "lame" spoofing attacks to redirect whoever you wanted to whatever site you wanted anyway.