Spoofing an IP over the internet

From: Simon (simon_at_xhz.ca)
Date: 11/22/04

  • Next message: Corey Watts-Jones: "RE: Securing Printers" 
    Date: Mon, 22 Nov 2004 00:49:43 -0500
To: security-basics@securityfocus.com

    Hi there,
       I'm fairly new to this list and I'm very interested in security. I'm
    currently programming a set of security functions to make a very strong
    authentication with PHP and MySQL.

       These functions deal with all the problems Web Application are prone to and
    will make sure the process is done quickly and securely.

       Then, to use it, you would just need a MySQL database, a PHP file and just
    add two lines of code. With the first use, the administrator can create all the
    security script needs to proceed, etc... Then the admin can set the security
    level, currently either IDENTIFY or AUTHENTICATE.

       I'm currently working in dealing with a possible DoS attack, where the user
    would send TCP/IP packets to the webserver with different information.
    Currently, I create a new Session ID if the pair [IPaddress/UserAgent] is not
    found. It would be easy for a hacker to just set UserAgent to an incrementing
    number, until the disk is filled with sessions. However, it would be very
    simple to just verify that one IP cannot have more than one UserAgent associated
    with it. And report by email a digest of all the problems in the last 10 minutes...

       Now comes my Critical question. Can an IP address be
    spoofed/forged/manipulated by someone on the internet?

       I've read about IP spoofing and it seems that the hacker would need to be in
    my LAN to do such action. So I was wondering if it was possible to change an IP
    address at will over the internet before opening a TCP/IP connection?

       If it's not possible, then I believe my anti-DoS process is fairly strong.
    But if it is possible, then I would like to know how a hacker can proceed (Does
    he needs to be an ISP or can an end user do it? Are ISPs checking this? What
    about the law and IP spoofing? Is there a way beyond this point where I can
    trust something on the internet?)

       Say for example, that I somehow determine the webserver is currently serving
    a user with a spoofed IP, what can I do to trust other visitors? What can I do
    to get more information on this hacker for further investigation?

    If you could direct me to some litterature on the internet about spoofing IPs on
    the internet, that would be very much appreciated, then if I can understand how
    a hacker would proceed I will change my Security mechanism to deal with such a
    possibility.

    Oh and btw, I will release the source code of the security engine so that people
    can read and verify it. Then I was thinking on possibly asking a commercial
    auditing company to check a test site for possible security flaws and this way I
    could put some sort of Guarantee on the script (the guarantee comming from the
    experts).

    Thanks in advance,
       Simon

  • Next message: Corey Watts-Jones: "RE: Securing Printers"

    Relevant Pages

    • Re: Spoofing an IP over the internet
      ... The secure authentication script will support many levels of security, ... in case a hacker cost me very much bandwith what is my ...
      (Security-Basics)
    • [NT] Vulnerability in Microsoft Data Access Components Allows Code Execution (MS07-009)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... this vulnerability by preventing Active Scripting and ActiveX controls ... mode sets the security level for the Internet zone to High. ...
      (Securiteam)
    • RE: Spoofing an IP over the internet
      ... > I'm fairly new to this list and I'm very interested in security. ... > I've read about IP spoofing and it seems that the hacker would need to ... > address at will over the internet before opening a TCP/IP connection? ...
      (Security-Basics)
    • Re: Authentication problem
      ... am just dealing with my own experience with multi-purposed .NET security ... forms authentication - is any more secure than a single instance ... config method based on which site you are deploying than you are setting ... such as the internet) or windows authentication (if ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: i am being cyber stalked
      ... However you can deter a hacker. ... breach your security the less likely you are to be hacked. ... building another computer to use on the Internet and even ... your IP address or a Trojan on your HD trying that will ...
      (microsoft.public.security)