IP Spoofing: Types, How It Works, Risks, and Prevention
Whether you’re browsing the internet as a private individual or responsible for a local network, protection against unauthorized access and system-damaging attacks is always crucial. For decades, criminals have been gaining access to other people’s computer systems and finding different ways to cause damage to the user devices. Usually, you won’t even notice the attack itself if the intruders are skilled.
Furthermore, many cybercriminals are adept at covering their tracks, making it virtually impossible to trace the origin of the attacks using conventional methods. One of the most popular techniques used by cybercriminals has always been spoofing (forging or falsifying information), which in its original form, IP spoofing, was already a topic of discussion among experts in the 1980s.
What Is IP Spoofing, and How Does It Work?
IP spoofing is a technique in which IP packets are sent with a fake source IP address. An attacker may use this technique to disguise the apparent origin of packets or to exploit systems that trust source IP addresses. In most cases, IP spoofing is used to carry out DoS and DDoS attacks. By itself, however, it does not allow an attacker to intercept or read responses sent to the fake source address. Intercepting or manipulating traffic generally requires additional techniques and network access.
IP spoofing is one of the techniques used in cybersecurity attacks. Understanding common cyber threats, how they work, and how to prevent them is an important part of building a strong security strategy. Learn more in our guide to cybersecurity.
Why Does IP Spoofing Work?
How Attackers Fake an IP Address?
IP spoofing is possible because the source IP address in an IP packet header is not inherently authenticated. Network filtering and other security measures can help detect or block packets with forged source addresses. With a simple IP spoofing attack, the attacker gains no access to the data traffic. They merely alter the address entry in the corresponding packet, while the actual IP address remains unchanged. Therefore, the response to the sent data does not reach them but rather the computer whose address they specified.
How is IP Spoofing Used in DoS and DDoS Attacks?
The fact that a third, unauthorized party is behind the IP packet remains hidden from the responding system, which makes IP spoofing usable for the aforementioned DoS and DDoS attacks. The following two scenarios are particularly conceivable:
- Based on the stolen source address, the attacker sends a large number of data packets to various systems within the respective network. These systems respond by also sending a data packet – specifically to the otherwise uninvolved computer whose IP address has been misused.
- A targeted computer receives data packets simultaneously from various spoofed IP addresses, which overload it.
The computers whose IP addresses the attacker steals can therefore either be the target of the DDoS attack or used as a tool in such an attack. In both cases, the source IP address may mislead the receiving system about where the packets originated, making it more difficult to identify the actual sender.
Types of IP Spoofing Attacks
| Type | How it works | Main purpose |
| DoS/DDoS spoofing | In DoS/DDoS spoofing, attackers forge the source IP addresses of traffic sent to a target. | The main purpose of DoS/DDoS spoofing is to disrupt service availability. |
| Blind spoofing | In blind spoofing, an attacker sends forged packets without directly observing the target’s responses. | Its main purpose is to attempt to exploit weaknesses in TCP communication. |
| Non-blind spoofing | In non-blind spoofing, an attacker can observe traffic on the relevant network path and use that information to forge packets. | Its main purpose is to attempt to impersonate a network participant |
How IP Spoofing Can Bypass the TCP Three-Way Handshake
An attacker can, in principle, initiate a deliberate overload from anywhere, provided the target computer is connected to the internet. In contrast, direct access to data traffic is now considerably more difficult if the intruder’s computer is not on the same subnet. This is because intercepting a data packet is only possible using the corresponding packet sequence number – an undertaking that is virtually impossible from outside the network today compared to earlier times. Historically, predictable TCP sequence numbers made blind spoofing attacks easier.
Modern systems use improved sequence-number generation to make these attacks more difficult, although implementation weaknesses can still create risks. An attacker on the same network path may be able to observe traffic and obtain sequence numbers more easily. In the past, operating systems and network devices generated these sequence numbers, which they entered in the TCP header according to a consistent pattern.
Attackers could thus easily send several packets to the targeted system as a test and, thanks to the acknowledgements, predict the next sequence number. They could then read or manipulate the packet behind that number and subsequently forward it with a spoofed sender IP address, without it being registered by the two communicating systems.
Because many systems relied on host-based login methods that transmitted login credentials like usernames and passwords unencrypted, an attacker could, with a bit of luck, actually establish a connection.
Since modern systems output sequence numbers randomly, these so-called TCP sequence prediction attacks (also known as blind spoofing) have essentially become ineffective – however, older devices remain vulnerable.
If the IP spoofer operates on the same subnet – for example, a local network – as the targeted system, it can obtain the sequence number and the underlying IP packets much more easily. Instead of labouriously determining them, it can filter and analyze all network traffic and extract the desired data packets. This is why it’s also called non-blind spoofing.
How to Prevent IP Spoofing Attacks?
For decades, the problem of IP spoofing has plagued security officers and IT professionals. The ease with which criminals can carry out DoS and DDoS attacks makes IP manipulation an attractive method even today. Consequently, there has long been a demand for targeted filtering of outgoing traffic by internet service providers, which would capture and discard packets with source addresses outside the underlying network.
However, the effort and cost involved are key reasons why such filtering has remained merely a demand, with no one willing to implement it. Another reason for the providers’ reluctance likely lies in the security features of the revised Internet Protocol version, IPv6. IPv6 includes security-related capabilities, and IPsec can provide authentication and encryption when properly configured.
However, IPv6 does not automatically prevent IP spoofing. The transition to the new addressing protocol has proven to be a very slow process so far, as evidenced, for example, by the lack of IPv6 support in various common network devices. To prevent an attacker from spoofing and misusing your IP address, you must take action and implement your own security measures. Focus on the following two measures:
1. Configure Packet Filtering on Routers and Security Gateways
Configure packet filtering on your router or security gateway. Apply appropriate ingress and egress filtering to reject packets with source addresses that are invalid for the network from which they arrive or are sent.
2. Use Encrypted Authentication Methods
Avoid relying solely on source IP addresses for authentication. Ensure that remote access and login methods use secure, authenticated connections. This minimises the risk of IP spoofing attacks within your network and also sets important standards for overall security.
3. Replace Outdated Operating Systems and Network Devices
Furthermore, you should of course also replace older operating systems and network devices if you are still using them. This will not only increase your protection against IP spoofing but also close numerous other security gaps.
Related Cybersecurity Topics
