Download presentation
Presentation is loading. Please wait.
1
IIT Indore © Neminath Hubballi
IP Spoofing Dr. Neminath Hubballi IIT Indore © Neminath Hubballi
2
IIT Indore © Neminath Hubballi
Outline Introduction IP address spoofing Mitigtion/Detection Techniques IIT Indore © Neminath Hubballi
3
IIT Indore © Neminath Hubballi
IP Address Spoofing IP spoofing is the creation of IP packets using somebody else’s IP address as source address of a IP packet Absence of state information makes IP protocol vulnerable to spoofing Peer is not authenticated IIT Indore © Neminath Hubballi
4
IIT Indore © Neminath Hubballi
Normal Interaction Source IP Destination IP Source IP Destination IP IIT Indore © Neminath Hubballi
5
Interaction Under Spoofing
Source IP Destination IP Source IP Destination IP IIT Indore © Neminath Hubballi
6
Interaction Under Spoofing
Source IP Destination IP When attacker uses a non existing IP address as source address Source IP Destination IP I have no way forward IIT Indore © Neminath Hubballi
7
IP Address Spoofing-Implications
Many network services use host names or address for identification and authentication Host wanting service prepare a message and send it to a remote service. Receiver either allows or disallows the service Many services are vulnerable to IP spoofing RPC ( ) NFS X window system Any service using IP address as authentication method IIT Indore © Neminath Hubballi
8
Defenses Against IP Address Spoofing
Ingress filtering Egress filtering Avoiding trust relationship based on IP address Unicast Reverse Path Forwarding TTL Value Packet marking IPSec Randomized Initial Sequence Number in TCP IIT Indore © Neminath Hubballi
9
Normal Scenario Source (192.168.1.1) Destination (192.168.2.1)
Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source ( ) Destination ( ) Source IP Destination IP TTL value 31 Destination as me. I should verify this packet (ttl=30) using TCP probe request
10
Normal Scenario (contd.)
I received a TCP Syn. I should reply back with SYN-ACK. Source IP Destination IP TTL value 1 Source ( ) Destination ( ) Source IP Destination IP TTL value Source IP Destination IP TTL value (32-30)=2
11
Normal Scenario (contd.)
Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source ( ) Destination ( ) Source IP Destination IP TTL value 31 I received probe reply from the same IP address with same TTL value, i.e. 30. Packet genuine.
12
Spoofing Scenario 1 Genuine source (192.168.1.1) Spoofer (192.168.1.1)
Destination as me. I should verify this packet (ttl = 29) using TCP probe request. Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source IP Destination IP TTL value 31 Source IP Destination IP TTL value 29 Spoofer ( ) Destination ( )
13
Spoofing Scenario 1 (contd.)
Genuine source ( ) Source IP Destination IP TTL value 1 I received a TCP Syn. I should reply back with SYN-ACK. Source IP Destination IP TTL value (32-29)=3 Source IP Destination IP TTL value 2 Spoofer ( ) Destination ( )
14
Spoofing Scenario 1 (contd.)
Genuine source ( ) Source IP Destination IP TTL value 31 Source IP Destination IP TTL value 32 I received probe reply from the same IP address but different TTL value, i.e. 30 (not 29). Packet Spoofed. Source IP Destination IP TTL value 30 Spoofer ( ) Destination ( )
15
Spoofing Scenario 2 Genuine source (192.168.1.1) Spoofer (192.168.1.1)
Destination as me. I should verify this packet (ttl = 29) using TCP probe request. Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source IP Destination IP TTL value 31 Source IP Destination IP TTL value 29 Spoofer ( ) Destination ( )
16
Spoofing Scenario 2 (contd.)
Genuine source ( ) Source IP Destination IP TTL value 1 I received a TCP Syn. I should reply back with SYN-ACK. Source IP Destination IP TTL value (32-29)=3 Source IP Destination IP TTL value 2 Spoofer ( ) Destination ( )
17
Spoofing Scenario 2 (contd.)
Genuine source ( ) Source IP Destination IP TTL value 31 I received two different TTL values for one probe request from the same IP address. Spoofing Scenario 2 detected Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source IP Destination IP TTL value 29 Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source IP Destination IP TTL value 31 Spoofer ( ) Destination ( )
18
Spoofing Scenario 3 Genuine source (192.168.1.1) Spoofer (192.168.1.1)
Destination as me. I should verify this packet (ttl = 30) using TCP probe request. Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source IP Destination IP TTL value 31 Spoofer ( ) Destination ( )
19
Spoofing Scenario 3 (contd.)
Genuine source ( ) Source IP Destination IP TTL value ICMP Time Exceeded Message? Means that packet was spoofed one. Source IP Destination IP TTL value (32-30)=2 Source IP Destination IP TTL value 1 TTL=0. I should return ICMP Time Exceeded message back to Spoofer ( ) Destination ( )
20
Spoofing Scenario 4 Genuine source (192.168.1.1) Spoofer (192.168.1.1)
Destination as me. I should verify this packet (ttl = 30) using TCP probe request. Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Source IP Destination IP TTL value 31 Spoofer ( ) Destination ( )
21
Spoofing Scenario 4 (contd.)
Genuine source ( ) Source IP Destination IP TTL value TTL=0. I should return ICMP Time Exceeded message back to ICMP Time Exceeded Message and TTL=30 both? Means attacker is sending the reply with guess. Source IP Destination IP TTL value (32-30)=2 Source IP Destination IP TTL value 30 Source IP Destination IP TTL value 1 Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 31 Spoofer ( ) Destination ( )
22
Spoofing Scenario 5 Spoofer (192.168.1.1) Destination (192.168.2.1)
Source IP Destination IP TTL value 32 Source IP Destination IP TTL value 30 Spoofer ( ) Destination ( ) Source IP Destination IP TTL value 31 Destination as me. I should verify this packet (ttl=30) using TCP probe request
23
Spoofing Scenario 5 (contd.)
I don’t know the route to destination so I should forward it to the default router by reducing TTL=0 I don’t know the route to destination so I should forward it to the default router by reducing TTL=1 The TTL value=0 so I should send back an ICMP Time Exceeded message back to the source. Any intermediate router Spoofer ( ) Destination ( ) ICMP Time Exceeded Message? That means the packet was spoofed one Source IP Destination IP TTL value (32-30)=2
Similar presentations
