IP Address Spoofing

IP address spoofing (known as "IP spoofing") is a technique used to forge the original source of Internet Protocol (IP) packets to impersonate another computer system with authorized access, hiding the sender's identity, or both. A bogus IP address source helps cybercriminals launch devious online attacks like Distributed Denial-Of-Service (DDoS). DDoS attacks are a widespread type of cyber threat that in recent years has accelerated in both volume and frequency. According to the University of California San Diego, between March 2015 and February 2017 alone, almost 30% of the internet was targeted by DDoS attacks.

In computer networking, the Internet Protocol is the primary framework used to send and receive data over the internet. Data is broken into several IP packets, which are autonomously transmitted then reassembled at the end. Every data packet contains a "body" preceded by a header filled with basic routing information, including the source IP address, among other general information (region, city/town). Further details on the sender's identity or the devices used are never disclosed. When the packet is spoofed, the sender address in the header has been tampered with by replacing the real origin (fraudulent in nature) with a seemingly legitimate, trustworthy one.

IP spoofing is illegal only when used for malicious purposes, such as stealing sensitive data and using it to commit fraud, identity theft, or other crimes. Otherwise, IP spoofing is perfectly legal if it serves, for instance, as a testing method for business websites.

IP spoofing allows cyber thieves to mimic and pass as trusted sources by using another source's IP to conduct malicious actions without being detected. Attackers can crash servers, infect devices with malware, and compromise personal data. IP spoofing poses the following dangers:

• IP-spoofing attacks could overwhelm and even shut down websites and corporate servers.
• Leaves innocent end-users vulnerable to having their personal data hacked, exposed, and exploited for fraudulent purposes like online fraud and identity theft.
• Allows cyber attackers to hide their real identities from law enforcement and avoid discovery by cyber-investigators.

The most common IP spoofing cyber-attacks are:

• Denial-of-Service (DoS) attack - using IP spoofing to run a brute force attack that crashes or slows down a server. Spoofed IP addresses overwhelm targets (websites or computer networks) with an avalanche of internet traffic and packets of data. DoS attacks can be either Direct attacks or reflection attacks.
• Man-in-the-Middle attack – an attacker unlawfully intercepts the communication of sensitive data between two machines without the sender or receiver being aware the transmission has been intercepted and altered by a third party.
• Masking Botnet Devices – botnets are a series of geographically dispersed but interconnected computers that perform repetitive tasks with malicious intent such as saturating websites, servers, and networks with data, crashing them, or sending spam and other malware.

Cybersecurity specialists have developed multiple strategies to recognize and prevent IP spoofing, such as:

• Monitoring networks for unusual activity.
• Implementing robust verification procedures even among networked devices.
• Validating all IP addresses or using network attack blockers.
• Adopting firewalls to protect computing resources.
• Migrating sites to IPv6 with enhanced encryption and multiple authentication steps.
• Deploying packet filtering (either ingress filtering or egress filtering) to discover traffic discrepancies and reject strange packets.
• Creating IPsec tunnels that encrypt traffic between routers, devices, or between routers and end-systems. In this case, even if the attacker captures the packets, the tunnel encryption makes them impossible to read and exploit.

A popular mitigation solution relies on Deep Packet Inspection (DPI) that goes beyond the source IP address and engages in-depth granular analysis of all data packet headers to spot and block abnormalities and suspicious traffic such as identical Total Length headers.

End-users can also take steps to minimize their exposure to IP spoofing:

• Monitor your private network for suspicious activity.
• Use access control lists (ACL) on router interfaces to reject suspicious outside traffic.
• Use spoofing detection software to reject data that seems to be spoofed.
• Avoid surfing the web and logging into online accounts through unsecured, public Wi-Fi hotspots.
• Only visit websites with secure encryption protocols like HTTPS (always ensure the padlock symbol is in the URL bar).
• Adopt other secure communication protocols like Secure Socket Shell (SSH) or Transport Layer Security (TLS).
• Hide your network behind a firewall that authenticates IP addresses and set it up to verify, filter, and blocks access against unapproved intruders.
• Secure your home Wi-Fi network, router, and all connected devices by changing default passwords and usernames with much stronger, unique credentials.
• Keep antivirus software up to date with the latest authentication, encryption, and security patches.
• Use a Virtual Private Network (VPN) that protects the personal data you send and receive by encrypting your internet connection.
• Never click links from email addresses you don't recognize. If you're asked to update or confirm your credentials or make a donation, manually type the website address in your web browser and proceed from there instead of risking falling victim to spoof emails or phishing.