IP Spoofing & Source Routing Exploits

#Forging the Origin: IP Spoofing Mechanics#link

IP headers contain a source address field that the sender fills out. Without cryptographic verification, routers blindly trust this field, allowing attackers to impersonate trusted internal systems or mask their origin.

Mechanics of IP Spoofing

Spoofing is trivial for stateless protocols like UDP or ICMP. For TCP, it's harder because the attacker cannot see the server's SYN-ACK response (it goes to the spoofed IP), making the three-way handshake difficult to complete without a MITM position.

# Scapy snippet to forge an ICMP packet
from scapy.all import *
send(IP(src='10.0.0.5', dst='192.168.1.10')/ICMP())

This Python script uses Scapy to craft a packet with a forged source IP. If the local router lacks egress filtering, this packet will leave the network.

The Demise of IP Source Routing

Strict and Loose Source Routing allowed the sender to dictate the exact path a packet must take through the internet. Attackers used this to bypass firewalls by forcing traffic through compromised intermediate routers.

• ▪Implement BCP38 at network edge
• ▪Drop packets with source routing headers
• ▪Enable uRPF on core routers
• ▪Monitor for asymmetric routing anomalies