What is IP spoofing?

IP address

Internet Protocol address in short IP address is an identifier for a computer or device on a network. Any device connected to the IP network must have a unique IP address within the network. An IP address is analogous to a street address or telephone number in that it is used to uniquely identify an entity.

An IP address can be static or dynamic. A static IP address will never change and it is a permanent Internet address. A dynamic IP address is a temporary address that is assigned each time a computer or device accesses the Internet. 

IP spoofing

Computer networks communicate through the exchange of network data packets, each containing multiple headers used for routing and to ensure transmission continuity. One such header is the ‘Source IP Address’, which indicates the IP address of the packet’s sender.

In IP spoofing, also known as IP address forgery, used to gain unauthorized access to machines, whereby an attacker illicitly impersonate another machine by manipulating IP packets.

The intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host. To engage in IP spoofing, a hacker must first use a variety of techniques to find an IP address of a trusted host and then modify the packet headers so that it appears that the packets are coming from that host.

Robert Morris first conceptualized IP spoofing when he uncovered what is known as sequence prediction within TCP. Morris noted this to be a gap in IP security. Certain design problems in the TCP/IP suite has lent itself well to cracking IP security and thus enabling IP spoofing.

When IP spoofing is used to hijack a browser, a visitor who types in the URL of a legitimate site is taken to a fraudulent Web page created by the hijacker. If a user interacts with dynamic content on a spoofed page, the highjacker can gain access to sensitive information or computer or network resources. He could steal or alter sensitive data, such as a credit card number or password, or install malware. 

IP spoofing is a default feature in most DDoS malware kits and attack scripts, making it a part of most network layer distributed denial of service DDoS attacks. It is used for two reasons in DDoS attacks: to mask botnet device locations and to stage a reflected assault.

In security research, IP data derived from network layer assaults is often used to identify the country of origin of attacker resources. IP spoofing, however, makes this data unreliable, as both the IP address and geolocation of malicious traffic is masked. When reading reports relying solely on network IP data, it’s necessary to be aware of these limitations.

Spoofing Attack Prevention

There are many tools and practices that organizations can employ to reduce the threat of spoofing attacks. Newer routers and firewall arrangements can offer protection against IP spoofing. Here are the most common spoofing attack prevention -

• Packet filtering: Packet filters inspect packets as they are transmitted across a network.
• Use spoofing detection software: There are many programs available that helps to detect spoofing attacks. These programs work by inspecting and certifying data before it is transmitted and blocking data that appears to be spoofed.
• Use cryptographic network protocols: Transport Layer Security, Secure Shell, HTTP Secure and other secure communications protocols bolster spoofing attack prevention efforts by encrypting data before it is sent and authenticating data as it is received.