Re: Re: is IP# in $ENV{REMOTE_ADDR} spoofable?

[jepri]

Err. I'm not sure here, but I don't think it's possible to fake a remote address. Provided that the webserver is reporting the TCP connection address, and not a header that the client is sending, the REMOTE_ADDR should always be correct.

The correct remote address is needed to build the TCP connection before the HTTP request is sent. This isn't true for things like ICMP where no 'connection' occurs.

Of course, the computer connecting to you may be have been cracked or trojaned, so it might be worth the time to drop the server admin a line and let him know that someone is meddling with his box. If he doesn't respond positively, report him to the MAPS RBL.

____________________
Jeremy
I didn't believe in evil until I dated it.

[mdillon]

Update: I just re-read what jepri said and realized that I was wrong in my initial response. He is correct that a spoofed IP address will prevent a TCP connection from being established, since the origin application will need to use the TCP sequence number from the destination server's SYN-ACK packet to completely establish the connection. The stuff I said only applies to connectionless IP protocols, not those with connections like TCP. Sorry. I have removed the original contents of this node to avoid misleading anyone.

A TCP connection can only be spoofed if the TCP sequnce number returned by the server can be predicted. If it can, then an attacker with the ability to spoof IP addresses can just send all the packets for the HTTP request without requiring the acknowledging packets from the server. This is referred to as "Blind TCP Spoofing". This article provides a decent overview.

[jepri]

I'm afraid that this is incorrect. You can't change horses midstream in a TCP connection. I've tried it and the connection locks up. The trick is that in order to open the connection, both parties must reveal their true IP, or the connection won't open. The TCP connection build-up works like this:
• The initiator of the session sends a segment with the SYN flag set to the recipient.
• Upon receipt of the segment, the recipient sends a SYN segment to the initiator with the ACK number set to the sequence number + 1, and sets new sequence number for its own end.
• The initiator then sends an ACK of its own in response to the recipient's SYN, with the ACK number set to the recipeint's sequence number + 1.

After these steps are completed, no data has been transferred, the connection is open, and both parties know the correct address of the other party. If one party fakes the address the connection will jam. This is the now-famous 'syn attack'.

This is how you are able to find out the remote IP address when you do a $socket->accept call to receive an incoming connection.

As I mentioned earlier (because I knew it would get brought up), it is possible to spoof ICMP packets, because ICMP does not build a connection like TCP does.

Also, earlier versions of windows can do raw sockets (otherwise they couldn't do any networking at all), but their native libraries don't have a API for raw sockets. There are libraries for these systems to provide raw sockets though.

____________________
Jeremy
I didn't believe in evil until I dated it.