Chawla Suneeta Web Security Presentation Topic : I P Spoofing Date : 03/24/04
I P Spoofing
What is I P Spoofing? A technique used to gain unauthorized access to computers, whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host
Base for I P spoofing The concept of IP spoofing was discovered as a security weakness in the IP protocol which carries the Source IP address and the TCP protocol which contains port and sequencing information.
I P protocol
IP routing is hop by hop. Every IP packet is routed separately. The route of a IP packet is decided by all the routers the packet goes through. IP address spoofing is possible because routers only require inspection of the destination IP address in the packet to make routing decisions. The source IP address is not required by routers and an invalid source IP address will not affect the delivery of packets. That address is only used by the destination machine when it responds back to the source.
TCP Connection Establishment
Types of Spoofing attacks
1. Non-Blind Spoofing Takes place when the attacker is on the same subnet as the victim. This allows the attacker to sniff packets making the next sequence number available to him.
Types of Spoofing attacks (contd.)
The first stage of this attack is to prevent Victim from sending RST packets to host Target once the attack begins. This can be done by flooding the Victim with SYN messages. Attacker initiates handshake message with the Target using the spoofed IP address. Target responds to the Victim with a SYN + ACK message which is sniffed by the Attacker to find out which sequence number is expected next for the ACK messages and sends it.
Types of Spoofing attacks contd.
2. Blind Spoofing
Usually the attacker does not have access to the reply. e.g. Host C sends an IP datagram with the address of some other host (Host A) as the source address to Host B. Attacked host (B) replies to the legitimate host (A) The sequence and acknowledgement numbers from the victim are unreachable. In order to circumvent this, several packets are sent to the victim machine in order to sample sequence numbers.
Types of Spoofing attacks contd.
Attacker connects to a TCP port on the victim prior to starting an attack to completes the three-way handshake, making sure that the initial sequence number (ISN) is recorded. This is repeated several times to determine the Round Trip Time (RTT) and the final ISN retained. The RTT is necessary to predict the next ISN. A spoofed ACK message is sent from the attacker to the server:
If the NSN is less than what is expected by the actual server, it considers it as a resent message and ignores it. If the NSN is correctly guessed, the target server responds back. If the NSN is greater than the expected but NSN it is within the window of packets expected by the server, the server waits until all the packets prior to that are received. If the NSN is greater than the expected NSN and is beyond the window of expected packets, the server just discards the packet.
Types of Spoofing attacks contd.
3. I CM P redirect The attacker sends a spoofed ICMP redirect message that appears to come from the host` s default gateway.
192.168.1.2
192.168.1.3 Forged packet
192.168.1.1
Internet
192.168.1.4
e.g. Host 192.168.1.4 sends a forged ICMP packet to host 192.168.1.3, saying the route through 192.168.1.4 is a better way to internet. The source IP address of this forged ICMP packet is the gateway' s IP address 192.168.1.1. Then all the traffic from 192.168.1.3 to internet will go through 192.168.1.4.
Services Vulnerable to I P Spoofing
1. RPC (Remote Procedure Call services) RPC multiplexes many services on top of one framework. Portmapper directs clients to the service that they want. Some of these services include NIS, NFS, and Exchange mail. Portmapper is usually secure, but the services below it often are not. 2. Any service that uses I P address authentication 3. X Window system You can run programs on other people's displays, snoop their keystrokes and mouse movements, lock their screens etc. 4. R services suite (rlogin, rsh, etc.) To prevent these sorts of attacks, users should have uncrackable passwords, and all shell access should be strongly authenticated and encrypted.
How to prevent Spoofing Attacks
1. Avoid using the source address authentication. Implement cryptographic authentication system wide. 2. Disable all the r* commands, remove all .rhosts fi...