Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Can You Spoof IP Packets?

Posted by CmdrTaco on Tue May 02, 2006 02:38 PM
from the something-to-think-about dept.
Security
nweaver writes "Spoofed IP packets are still believed to be a significant problem for the Internet. But are they? The Spoofer Project is attempting to measure the problem. Apparently, 80% of the IP addresses measured no longer support spoofing! Their methodology is simple: have users download a client which attempts to spoof packets to the monitor. Using these packets, they can determine the filter rules. So everyone, download the client and help!"
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Can You Spoof IP Packets? 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Oh yes! (Score:5, Funny)

    by aardwolf64 (160070) on Tuesday May 02 2006, @02:41PM (#15248252) Homepage
    Oh yes! Everyone download this executable from known IP Spoofers and run it. It won't root your system, we promise...

  • Yay! (Score:5, Funny)

    by Renraku (518261) on Tuesday May 02 2006, @02:41PM (#15248253) Homepage
    Even you can help the next generation of scammers find an ISP to call home!

    • In related news.... (Score:5, Funny)

      by Mayhem178 (920970) on Tuesday May 02 2006, @03:23PM (#15248640)
      ...the other 20% of spoofable IP addresses are reported to be in the possession of Weird Al Yankovic, who, according to US Attorney General Alberto R. Gonzales, is capable of spoofing damn near anything.

      A full-blown investigation is under way to put an end to Weird Al's wild spoofing. Rap legend Coolio has pledged his support in these investigations.

      Weird Al was unavailable for comment, but his assistant did pass along his official response, which was, "Mecha lecha hi, Mecha hiny hiny ho."

      More at 11.

  • Yes. Yes, I can (Score:5, Funny)

    by no reason to be here (218628) on Tuesday May 02 2006, @02:42PM (#15248259) Homepage
    Oh wait. This isn't an "Ask Slashdot"?

    Nevermind...

  • Sounds dangerous (Score:5, Insightful)

    by suso (153703) * on Tuesday May 02 2006, @02:42PM (#15248260) Homepage Journal
    1. Write a piece of software claiming to help monitor spoofed IP packets but really it does something more sinister.
    2. Post a story to Slashdot with a link to the software on an MIT server and ask people to run it on their internal networks and send the data back to the author.
    3. ???
    4. Profit and say to yourself, "suckers"

    Maybe I'm too paranoid. But this is a good example of how social engineering can be used to get you into places you shouldn't be. I guess the source cod
    e is provided. How many people will really read it?

    • Re:Sounds dangerous (Score:3, Funny)

      by Anonymous Coward
      Maybe I'm too paranoid. But

      No buts, YES, YOU ARE TOO PARANOID!

      Then again, you probably think I am one of them programmers now typing up this cover-up reply.

    • It's a collaboration between Slashdot and MIT to finally get adware on Linux machines.

    • You should be paranoid in these days, and yes, the source code is provided. There is 1090 lines of source code including the Makefile, so I don't think it would take that much time to read it trough.

      To answer the question how many people will really read it, I answer that I won't compile nor run it before I have read it.

    • Use SELinux (was Re:Sounds dangerous) (Score:4, Informative)

      by giminy (94188) on Tuesday May 02 2006, @03:14PM (#15248555) Homepage Journal
      Create an selinux policy to ensure that this software doesn't do anything weird. Give it no access to your filesystem (it shouldn't need it) and ability to use libnet (or whatever it uses to generate the packets). Voilla, paranoia (mostly) gone.

        • Fools! (Score:3, Insightful)

          by suso (153703) *
          Hey, the point is that you're already giving it access to your network through root access on your machine so that you can generate special packets. Its not much of a step from that to sniffing your network for packets. And the big deal is that the program is sniffing or scanning your network from INSIDE your network, behind DMZ firewalls, etc. Using SELinux or virtual machines won't necessarily protect you and I wasn't refering to a local machine exploit in my original post.

    • UTSL (Score:3, Informative)

      by Dom2 (838)
      Use The Source, Luke

      Seriously, they provide source. It's a small program, you can browse it and get the gist of what it's doing in fairly short order. You can change it any way you want, and recompile. beautiful, isn't it?

      The program doesn't have a particular license attached though, I would assume that the intention is that it be licensed under the MIT license. Mighht want to check that before packaging it for Debian.

      -Dom

    • Source code is provided, but will anyone bother to check that the compiled result matches the binary provided?

  • Packets to my monitor, eh? (Score:5, Funny)

    by ip_freely_2000 (577249) on Tuesday May 02 2006, @02:42PM (#15248264)
    "have users download a client which attempts to spoof packets to the monitor"

    But my monitor does not have an ethernet port! Can I send packets into my DVI port?
  • ...No.

    Seriously, why would I want to participate in this?
    • I'm having difficulty figuring it out too.

      IP spoofing isn't even a bad thing. There's a work-around that allows two hosts hidden behind NAT gateways to communicate directly with one another by having them both spoof a cooperating proxy. (It goes something like: Host A establishes a UDP link with the proxy, Host B establishes a UDP link with a proxy, Proxy then gives A enough information to allow it to spoof packets as Proxy and send them directly to B, and proxy gives B the information needed to spoof packets from Proxy to A.)

      This is useful in some P2P applications, notably VoIP.

      This is going to break if spoofing some how gets prevented completely, and from what I can figure out, that's what the above system is treating as some kind of "hole" that needs to be fixed.

      • It is a hole that needs to be plugged. Any trick you can do with spoofing, you can do without. Yes, it's more work. You could argue that it's easier to run your P2P applications without a firewall since you don't have to go to all that extra trouble to set up the firewall. It's more work, but, you can bet that I'm darned well going to go to the trouble to configure my firewall instead of shutting it off. IP spoofing isn't as dangerous, but, it definitely has its security problems. Overall people are b

        • Any trick you can do with spoofing, you can do without

          No, you can't.

          You could argue that it's easier to run your P2P applications without a firewall since you don't have to go to all that extra trouble to set up the firewall.

          The example I gave had nothing to do with firewalls. It's about NAT. NAT's a technology that means multiple devices can share a single Internet connection. Getting multiple IPs isn't an option for most households, nor is dedicating the entire connection to one machine always prac

  • On my patched FC3 boxes I get an error after trying to run the Linux client. "Server terminated prematurely". Now I'm going to download and run the Windows cient.

    Not.

  • Spoofage (Score:5, Funny)

    by iXiXi (659985) on Tuesday May 02 2006, @02:45PM (#15248281)
    My packets have spoof all over them ! Anyone have a tissue?

  • Warning (Score:5, Informative)

    by Kwiik (655591) on Tuesday May 02 2006, @02:46PM (#15248288)
    This took out my wireless network on XP Home SP2 using Microsoft's wireless zero configuration tool for the software side of it. During the spoof portion of the test, all network connectivity halted and immediately reported that the wireless connection had disconnected.

  • Great way to destroy the project (Score:3, Funny)

    by isaacklinger (966649) on Tuesday May 02 2006, @02:49PM (#15248311)
    Getting too many connections from slashdotters...?

  • If you TRULY want to know... (Score:5, Insightful)

    by MindPrison (864299) on Tuesday May 02 2006, @02:50PM (#15248330) Journal
    ...you can use a network packet monitor, and there's two ways to get your hands on such a device - the cheap...and the expensive way, the expensive way being the safest one (A hardware network monitor = hardware device to look and monitor what's going in/out of your ethernet connection directly connected to your "whatever" device)

    or

    Do the same thing by rigging a second computer, also known as a network monitor. Set up a Linux box...and monitor & control all the ports & packets being delivered to your network, and if you do your homework - you will "know" if that application you just downloaded and executed...truly is honest...and "doesn't phone home...like E.T"... he he he..
    Live and learn kids.

  • It's true (Score:5, Funny)

    by rudy_wayne (414635) on Tuesday May 02 2006, @02:52PM (#15248349)
    Nearly 5 years ago, the great and all knowing Steve Gibson [grc.com] predicted that the raw sockets in Windows XP would allow packet spoofing that would bring down the internet with unstoppable DOS attacks.

    So it must be true.

    • Nearly 5 years ago, the great and all knowing Steve Gibson predicted that the raw sockets in Windows XP would allow packet spoofing that would bring down the internet with unstoppable DOS attacks.


      So it must be true.

      I really hope that is sarcasm. Yes, it must be. However some of the other replies are not, which worries me slightly as people don't seem to realise Gibson is the guy behind Spin Rite. Spin Rite, people. Think of that next time you read some of his "advice".

  • Spoofing has not been a problem for years (Score:5, Insightful)

    by Zarhan (415465) on Tuesday May 02 2006, @02:57PM (#15248384)
    ...every self-respecting network operator has RPF (or some other antispoof-ingressfilter) enabled at the edge. Gone are the days of spoofing, just like respecting IP packet's loose/strict source routing options and other similar exploits :)

  • Spoofed UDP packets (Score:3, Interesting)

    by caluml (551744) <slashdot&spamgoeshere,calum,org> on Tuesday May 02 2006, @03:00PM (#15248410) Homepage
    Spoofed packets were the idea behind an anonymous P2P network I envisaged, and designed a few years ago. udpp2p.sf.net [sf.net], if you're interested. Man, that was ropey code. (I didn't write any of it, by the way!)
    • I've plugged the project a few times here on /. before, as I had a very similar myself long before udpp2p existed.

      I think it's a real shame development has stopped, as it had the potential to be as fast as any other P2P network, and completely anonymous for the sender. All without requiring extensive communities and webs of trust to decide who to allow full access to your encrypted P2P VPN.

      As to the retransmit problems listed on your site, you should really use the Gnutella model, but broadcasting ACKs in
  • I think that the server that the client connects to is having a few problems. We've slashdotted a spoofing TCP server.
    arse spoofer-0.4 # ./spoofer
    >> Spoofing Tester v0.4
    >> Rob Beverly <rbeverly at mit dot edu>
    >> More information: http://spoofer.csail.mit.edu/
    >>
    ** server terminated prematurely** server terminated prematurely>> Source 5 non-spoofed packets...
    >> Source 5 spoofed packets (IP: 1.2.3.4)...
    >> Source 5 spoofed packets (IP: 172.16.1.100)...
    >> Source 5 spoofed packets (IP: 6.1.2.3)...
    Broken pipe
    arse spoofer-0.4 #

  • waste of time (Score:3)

    by frovingslosh (582462) on Tuesday May 02 2006, @03:07PM (#15248484)
    The win versionh is less than useless. Doesn't work on Win98. When I tried it under XP it ran, but in a command shell and then tried to start IE. Well, IE will never get past my firewalls, and I couldn't tell much from the giberish the stupid client printed out (the final html link it gave me was useless).
  • He's talking about the tenants of the Internet architecture in his introduction... should I assume he means the electrons, or the switches?

  • Obvious ? (Score:4, Insightful)

    by Martin Spamer (244245) on Tuesday May 02 2006, @03:15PM (#15248564) Homepage Journal

    80% of the IP addresses measured no longer support spoofing!

    Given the move to broadband with home routers and NAT it seems obvious that spoofing capable networks are on the decline.

  • I'll download only if: (Score:5, Funny)

    by psbrogna (611644) on Tuesday May 02 2006, @03:21PM (#15248613)
    These additional demands are met:
    1. a free lollipop.
    2. a car ride deep in the forest
  • The questions is not can an IP be spoofed (yes, it can always be spoofed from somewhere), but rather from where can it be spoofed and to where can it be spoofed to. You can spoof any IP address to another box on your local ethernet segment -- there are no routers en route that can drop the packet. You probably cannot spoof an IP to someone on the other side of the world, but your ISP or your ISP's ISP can. In fact, you can spoof any IP to almost everywhere if you have a connection to one of the few core Internet routers.

    The project basically is saying that home users cannot spoof IPs to their measurement server. That's well and good, but useless.

    Home users no longer need to spoof IPs to hide the source of the attack (as in days past). Home users now are simply trojan/zombie boxes that are hiding the true source of the attack by using their own IP -- no spoofing required. Back when zombies were not a problem, attackers used spoofing to hide their true location; it is no longer required now that boxes can be 0wned with relative ease.

    I don't see the point of this project.

  • Unique? (Score:5, Funny)

    by iminplaya (723125) <.iminplaya. .at. .gmail.com.> on Tuesday May 02 2006, @03:26PM (#15248655) Journal
    Apparently, 80% of the IP addresses measured no longer support spoofing!

    Yes, but how many of those are unique IPs?

  • Yeah right (Score:3, Insightful)

    by jafiwam (310805) on Tuesday May 02 2006, @03:38PM (#15248771) Homepage Journal
    So I can get my ISP pissed at me and watching what I do because attempting to spoof packets is something "hackers" do.

    I like my broadband too much to participate in anything that even LOOKS bad to the security idiots watching my cable modem.

  • wow (Score:4, Funny)

    by stinky wizzleteats (552063) on Tuesday May 02 2006, @03:39PM (#15248774) Homepage Journal
    Why don't we do something less invasive, like snmpwalk every address on the Internet?

  • What's the point? (Score:3, Insightful)

    by causality (777677) on Tuesday May 02 2006, @04:15PM (#15249054)
    There's one thing I seem to be missing in all of the comments here: what's the point of this exactly?

    The massive DDoS attacks generally come from botnets that do not need to bother spoofing their source IP. Also, anyone who relies on IP address alone (especially with "connectionless" protocols like IP/ICMP/UDP) for their security needs is just begging for problems because they're trusting a network that is not trustworthy. Seems to me it would be far easier to discourage the practice of trusting an untrustworthy network -- the black hats seem useful for this purpose -- than it would be to check each and every individual subnet for whether they will pass spoofed packets.

    Given this, what does it matter whether I can spoof UDP/ICMP packets? What service or what architecture that is widely used today is so brain-dead that it does not require a password or strong encryption or some other form of security and/or authentication that would ensure that spoofing the IP address does not constitute a successful attack?

    All of this would have been great ten years ago but today, the DDoS kiddies and spam botnets are enabled by the unwillingness to value security on the part of too many Windows users with broadband connections, combined with Microsoft's inability or unwillingness to market a secure-by-default OS. I say "market" here because I am assuming that with the resources at their disposal, Microsoft could create an extremely secure OS, if they really wanted to. Just look at what the OpenBSD team has done with far fewer resources available to them.

    And yes, I see that as a responsibility of Microsoft's since their fortunes are largely built by mass-marketing a technical product to the non-technical, "I just want it to work with zero effort" crowd (and apparently this type of can't-be-bothered-to-learn-anything user wants it to be the first thing in this life ever observed to do so, other than entropy). If Windows were marketed exclusively to computer security specialists then I would not blame Microsoft if extremely insecure configurations kept happening.

    So anyway, somebody please explain to me how it will matter one way or the other whether 0% of all internet users can spoof or whether 100% of them can spoof.

  • Got Root?! (Score:5, Funny)

    by 955301 (209856) on Tuesday May 02 2006, @10:20PM (#15251161) Journal

    Blockquoth the poster:

    On *nix systems, you must run the spoofer as root (in order to create
    the raw socket) with no arguments, e.g.
          # ./spoofer

    Ahahahahahahah! You're kidding, right?

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.