Prevent IP Address Spoofing
“Things are not always what they seem; the first appearance deceives many”. Phaedrus.
IP Address Spoofing is sometimes referred to as IP Address Forgery, and as the name suggests it’s a technique commonly used by hackers to perform malicious activities, such as Man in the Middle (MiTM), Denial of Service (DoS) and Dedicated Denial of Service (DDoS) attacks. It is generally used to maintain anonymity and cause havoc on the Internet.
To first understand what IP Address Spoofing is; and how it is used, we need to have an appreciation of the underlying protocol(s) that open the door for manipulation. Which essentially is IP, TCP and UDP and the ability to manipulate the packet header information (source address field).
Current State and Attacks
In an age of Botnets where an attacker has a layer of abstraction behind a command and control server, some people think that IP Address Spoofing is no longer an issue. When in fact the reality is the opposite, IP Address Spoofing remains a real problem to defend against. In some cases, IP Address Spoofing is necessary for an attacks success, where it provides an additional layer of anonymity and protection for a botnet (see DNS DDoS Amplification Attack).
So, due to the inherent ability to manipulate a packets header in the protocol stack is where the ability to perform malicious attacks such as:
MiTM – Where a malicious user intercepts a legitimate communication between two parties. The injected, malicious host then controls the transmission flow and can eliminate or alter the information within the data stream without the knowledge of the original sender or recipient. In this scenario, the attacker fools the victim into disclosing confidential information by “spoofing” the original sender’s address / identity.
DoS / DDoS – Since some malicious users are only concerned with consuming resources and bandwidth, they attempt to “flood” the victim network with large volumes of traffic to consume system resources. In order to maintain the effectiveness of the attack, the attacker will “spoof” the source IP addresses to make stopping and tracing of the attack as difficult as possible. This is amplified when multiple compromised hosts all have “spoofed” addresses and are participating in the attack.
What can you do to defend against IP Address Spoofing attacks?
Firstly, ensure that your firewall and routers are configured correctly and restrict the advance of forged traffic from the internet. For many years now firewall vendors have included a configurable anti-spoofing defence mechanism to block the use of private (RFC 1918) addresses on the external interface. In addition, the external (internet facing) interface should not accept any addresses that are used in the internal network range as the source. You should also prevent source addresses from outside of your valid public network range, which will prevent any of your neighbour’s from sending spoofed traffic to the Internet.
As an example, if the attacker sits within the 22.214.171.124/24 network range that is provided Internet connectivity by ISP D. An input traffic filter on the ingress link of router 2 (which provides internet connectivity to the attacker’s network) restricts traffic to allow only traffic that originates from the source addresses within the 126.96.36.199/24 network prefix and prohibits the attacker from using any “invalid” source addresses that reside out of the prefixed range.
How can FireMon Help?
IP Address Spoofing is a difficult problem since its inherent weakness is due to the design of the protocol suite. However, understanding how and why one would use a spoofing attack can greatly increase your chances of successfully defending an attack. Using Security Manager, FireMon provides the ability to perform a regular assessment of your firewall and its configuration against best of breed configuration practices. Security Manager includes a number of pre-built compliance reports that will save your security administrators valuable time and effort and assist your organization to quickly find misconfigurations, the implementation of risky services and unused rules that could expose your network to attack.
A quick glance at the Firewall Configuration Best Practices report can provide your security managers with the detailed information needed to appropriately manage your organization’s security on a regular basis.
Each configuration check that Security Manager is able to perform can be drilled into by clicking the item to show more detail.
Don’t be fooled by a masquerading IP
Contact a FireMon representative today for a demonstration of Security Manager and how we can help your organization and prevent your systems from being spoofed.