Hacker News Reader

Comment by lossolo | Hacker News Reader

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not originate from your network. It would make ddosers life harder.

View on HN

I used to have a regular retail network connection at the office (local DSL carrier, not some industrial-grade expensive fiber thing) that allowed spoofing. The office was multi-homed (we had a second connection from a different provider for redundancy -- it turns out that our major local incumbent provider had maybe one nine of availability), and the results were hilarious. It turns out that, because Linux considers IP addresses to belong to a computer and not to an interface, it's fairly easy to (mis-)configure things so that traffic with a source address belonging to one interface goes out the other interface. This, coupled with spoofing being allowed, meant that we sometimes accidentally spoofed ourselves, and it worked! We went for surprisingly long times without noticing that some of our TCP connections went out one pipe and back in the other.

If I remember right, we would only notice it when we were confused by packet captures, when we had strange performance problems, or when we'd discover that we suddenly had two single points of failure. :)

This sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to them being smaller, regional ISPs without the expertise or staff to figure out how to do this.

I hear you saying "just blackhole them until they figure it out," but it's not that easy. In many cases, the small regional ISP is the customer of a larger ISP, who is the customer of an even larger global ISP that you are connected to. You just see XXXgbps of traffic coming from your ISP, and have no idea which one (or more) of their customer's customer's are sending the traffic.

This would be like saying "just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed?

You use netflow to identify the offender of course!

LOL - there's a netflow and ipfix/ipfreely joke in there somewhere...

> just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed?

Sounds like a logic puzzle. I'm thinking a binary search would be the most efficient way.

I think K-means would work best-- whichever cluster is closest to the "hot zone" gets the boot. :P

How do you measure a hot zone, sensors at the bottom of the pool? Or at middle-depth but along the edges?

Well you know the pee is coming from 1 of 3 (or maybe all 3) guys. You just threaten to kick them all out if they don't figure out which one is doing it.

This is a serious problem and it should be treated with serious consequences.

I agree 100%.

I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.

My ISP does that (XS4ALL, the Netherlands). Of course they can't know everything but if they receive abuse reports, notice your IP got blacklisted for spam or some honeypot network got a whiff of your IP address running malware variant XYZ, they put your IP address in quarantine (only 80 and 443 outgoing I think, or maybe only to the ISP's own website or something) and ask what's going on.

I can tell you they're a real pain to convince to unblock you when you are 17 and have been a bad netizen. Which is a good thing.

When it comes to ip spoofing based ddos attacks, the ISPs capable of tracking spoofed traffic on their network don't allow spoofed traffic. If they don't allow the spoofed traffic, you aren't participating in the DDoS.

Absolutely. No ISP should allow a packet with a spoofed IP leave it's network.

Is there an easy way to figure out if it's possible on my ISP's network?

Run tcpdump on an ec2 instance and send spoofed traffic to it to see if it shows up. :)

It's about blocking non-spoofed attacks.

Support costs for shutting down the average user are higher than the costs of bandwidth. Telling someone that their internet was shut off because their device was used in a botnet would lead to very long support calls and escalations.

Then people and businesses that are DDOS'd should be able to recover damages from the ISPs.

That would penalize a whole pile of parties that probably have nothing whatsoever to do with the spoofers. It's akin to blackholing mail from yahoo.com because there are spammers on yahoo.com.

Isn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?

No, if you drop the BGP route the whole range disappears, not just the host that spoofs the IPs. So it kills off a whole pile of innocents as collateral damage.

I don't know if I understand. At first I thought you meant that we shouldn't drop entire providers because one of their customers spoofed an IP, but of course the burden should be on those providers to make sure spoofed packets can't leave their network (since further up the chain you're getting packets that are originating from many networks). Are you talking about something else?

BGP route is on the receiving end.

You stop peering with providers originating spoofed traffic. The whole point is that you don't know which host is doing it (the IP is spoofed!). All you know is that a provider is allowing spoofed packets (with a probe from participating endpoints in a measuring service). That provider should be dropped and everyone on that provider should suffer collateral damage because that's the only way to economically incentivize them.

Now that subscription based walled-gardens are becoming the new internet, I don't expect freedom (outsiders) to be much of a concern for society.

What legitimate purpose is there for spoofing your IP address?

I think there are probably many of them but they are hard to think of because they would relate to unusual situations. There at least one very nice that I know : if you are hosting something (eg a webserver) behind a connection with limited upload capabilities like a consumer grade DSL, you can very easily aggregate multiple uploads links with nothing more than a bit of iptable magic. It would be completely transparent to the downloading peer.

Most cases (this one included) are covered by a proper BGP setup (you advertise to each upstream) or an email conversation with the upstream ISP to get another IP allowed.

These are still likely to be IP addresses in an IP range the ISP is responsible for routing. This is the big need. ISPs need to stop packets on egress that are from IP addresses not in the ISPs network. There's no excuse for it and it would drastically undermine a sizeable number of DDoS attacks (not every DDoS, because they don't all require IP spoofing.)

Unfortunately this requires ISPs to actually be responsible for the data coming out of their network, including DDoS traffic. Once you stop the spoofing, ISPs and transit providers will soon figure out which ASs are problems and start blocking them etc.

>There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce.

With what hardware?

If you're a transit provider, peering partner, or are an eyeball or content org with networking gear, this is trivial on your edge gear.

There is no excuse except laziness for not doing do.

https://tools.ietf.org/html/bcp38 (Note: This is from May 2000)

I suspect there is some excuse.

There is an excuse for not "securing" the network: disallowing spoofing is not desirable in the first place. There are legitimate uses to spoofing. What is not desirable is malware infecting user computers and using spoofing for DDoS attacks, but the ISP cannot know whether the packets were sent by malware or by a user. The proper way to solve the issue is to make secure systems that will not get infected easily by malware.

Why is disallowing spoofing not desirable in the first place? What legitimate uses to spoofing can you enumerate? Because I see none in your comment.

Reply on news.ycombinator.com