Spoofing is an activity when a person or program try to impersonates itself as another.

learn more… | top users | synonyms

56
votes
15answers
10k views

Are IP addresses “trivial to forge”?

I was reading through some of the notes on Google's new public DNS service: Performance Benefits Security Benefits I noticed under the security section this paragraph: Until a standard ...
16
votes
4answers
25k views

Can the IP address for an HTTP request be spoofed?

On a website I am building, I plan to log the IP addresses of submissions, just in case it's necessary. I don't mind proxies, but outright spoofing your IP address would defeat the purpose. To ...
7
votes
1answer
3k views

How to prevent IP spoofing using MAC and ebtables?

I am trying to create IP-MAC pairing rules in ebtables. There are few tutorials and related questions [1] available but I have kind of specific setting. ENVIRONMENT: I have many physical hosts. Each ...
6
votes
5answers
957 views

Any way I can correct DNS spoofing against our domain

This morning I found out that our domain and subdomains have been poisoned on the 4.2.2 and 4.2.2.1 DNS servers along with others I think, though I have not confirmed others yet. Using OpenDNS ...
6
votes
1answer
2k views

Does postfix reject spoofed senders?

Is there a reliable way to reject incoming mails with a spoofed e-mail address? What kind of checks does postfix run normally on incoming mails? does postfix check the reverse dns by default? does ...
6
votes
6answers
4k views

How reliable are IP address-based firewall restrictions?

On some of my production systems that need to be accessible outside of the LAN I will sometimes add a firewall restriction at the edge to only permit traffic on, say, RDP from a specific origin IP ...
6
votes
3answers
7k views

How to prevent ip spoofing within iptables?

My Apache web-server on Linux is being flooded by massive requests for a non-existent file. The immediate impact is the rapid growth of the access & error log. I already took care of this by not ...
5
votes
4answers
884 views

MAC address spoofing - why doesn't this work?

So I'm in a new job, and they're pretty draconian about their network, hardware, and OS security. :-( I'm a web developer, but am forced to use IE7 for development simply because they don't want ...
3
votes
3answers
384 views

How to Limit the Damage of Domain Spoofing

My e-mail account, for my privately run business which I'll call "VeryCoolCompany", is starting to receive bounce-backs for users who don't exist, like these: alan12ab1@verycoolcompany.com ...
3
votes
1answer
849 views

How did this email bypass my SPF settings?

I received a phishing email this morning that appeared to come from one of my addresses to itself. Looking at the headers, I found something interesting. DomainKey-Status: no signature ...
3
votes
1answer
94 views

Exchange not checking SPF record for own domain

I have an interesting issue with Exchange where it appears to check and stamp spoofed messages from external domains but not ones it has setup to send from. For example I can spoof a message from ...
2
votes
2answers
147 views

If I use iptables to allow TCP connections only from a specific IP, can it be faked?

An iptables rule on my database server is: -A INPUT -p tcp --dport 6432 -s 10.115.0.150 -j ACCEPT I have other rules (loopback, etc.), but I'm wondering if that specific rule can be "hacked". Can ...
2
votes
1answer
70 views

Checking SMTP headers for spoofed email (did client authenticate?)

I have been using rackspace email service, and I am finding that rogue emails are seemingly coming from harry@mydomain.com to james@mydomain.com but were never actually sent by that user. As per ...
2
votes
3answers
2k views

Stop spoof emails in Google Apps

Desperately need some help here. I've been using Google Apps for my domain (2qubed.co.uk) for over 2 years now with no problems at all until recently. For the past few months I have been getting lots ...
2
votes
2answers
263 views

Can IP spoofed traffic get above the transport layer?

I'd like to know whether you could get packets with a spoofed IP address above the transport layer. My thoughts are: TCP: No, as acknowledgements would never get to the original sender if their IP ...
2
votes
1answer
1k views

How can I prevent spoofed emails from outside thats using my internal accepted domain

I'm receiving spam emails sent from my own domain to my own domain. I'm using Exchange 2013. Example: myemail@mydomain.com is being used to send spam to myemail@mydomain.com. I can successfully ...
2
votes
1answer
66 views

Using SPF for spoof protection

I'm trying to work through properly configuring SPF for my domain. We have two MX servers that only receive mail, and two outbound relay servers which we expect to list in our SPF record. We also ...
2
votes
1answer
378 views

Dovecot Sieve allows spoofing through LMTP

I have set up Postfix to block spoofing your email (you can only send emails as yourself): smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch I have set up Sieve and ...
2
votes
1answer
882 views

Prevent mail server (sendmail) used to backscatter

Hi I recently got an email from Amazon, saying that my EC2 instance is sending spam. So what they say is my mail server is receiving email for a non-existing user and therefore bounces the email back ...
2
votes
1answer
646 views

“From:” e-mail header spoofing - how to verify such mail?

I'm facing a problem of verifying a "From:" message field in e-mail messages, in terms of e-mail spoofing. I am currently using SPF and DKIM to verify the origin and integrity of messages, but as far ...
2
votes
2answers
3k views

Reject obviously spoofed messages in Exchange 2007 SP2

I have an Exchange 2007 SP2 server which happily accepts SMTP messages whose sender is SomeRandomString@mydomain.com and the recipient is SomeRealUser@mydomain.com; this leads to all sort of spoofing ...
1
vote
3answers
1k views

How to avoid DNS spoofing for DNS lookup

I am trying to find a way to obtain the real ip addresse(s) for a domain name. I'm working on a router doing traffic shaping with the use of iptables and tc. I then need to setup iptables rules for ...
1
vote
2answers
512 views

Wrong DNS answer with CNAME and A Record at the same time

We had a customer which has set a CNAME Record for his domain. Somehow he managed it to set an A Record too, which should be not possible and is forbidden by DNS. But the result was: $ dig ...
1
vote
2answers
441 views

Spoof database connection to be local instead of remote

I am trying to connect one of our clients "as is" programs to a remote database instead of a local one, they think that they have coded it to work that way, but for some reason the program crashes ...
1
vote
1answer
602 views

Any way to block IP address host header spoofing?

I have already added the following the following to my nginx config to deal with spoofed domains: if ($host !~* ^(.*example.org|\d+\.\d+\.\d+\.\d+)$ ) { return 444; } Right now ...
1
vote
2answers
4k views

Different Mac address to virtual interface and primary interface

I am developing a system, where I need virtual interface to have different mac address for my primary and virtual interface lets say my mac for eth0 is 00:11:00:11:00:11 and my virtual interface is ...
1
vote
2answers
5k views

ISP login, MAC spoofing, WiFi and multiple devices

I have a Tikona Digital Broadband (WiMax based) Internet Connection which allows limited number of devices to be connected at a time and also requires that the users login with username and password ...
1
vote
1answer
451 views

DDoS false IP attack [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
1
vote
1answer
798 views

Using arpwatch to backtrack proxy access ip to eap-tls certificate

In my network I am using eap-tls authentication (machine certificates) for clients. Those clients are using a squid proxy to access the internet. The proxy is logging the request to the access.log. ...
1
vote
2answers
225 views

MAC spoofing - keeping the connection alive

Is it possible to keep a connection alive, while spoofing/changing the MAC address of your own network adapter (especially wlan adapter), without needing to re-authenticate against 802.1X ...
1
vote
1answer
194 views

Preventing Email Spoofing

I use Google Apps with my domain. Recently, we have begun to receive spam that gets past Google's spam filters. They are from our own email addresses. I am wondering how to prevent this kind of ...
1
vote
1answer
109 views

Prevent IP Spoofing on OpenVPN tun

I have a question regarding IP Spoofing and authentication. I have an OpenVPN server in TUN mode with many untrusted clients in the same VPN network, and I was wondering if one client is able to spoof ...
1
vote
1answer
566 views

Practical way to implement prevention of IP Spoofing

I am an undergraduate Computer Science student and was hoping to gain some knowledge of ways to help prevent IP spoofing but all the resources I have tried out elaborate this concept in a theoretical ...
1
vote
1answer
1k views

When a client sends a RST packet, will the server close the connection ?

What I'm trying to do is block RST attacks with IPTables. When I do a search for it, I'm seeing rules where packets with the RST flag set is being rate limited. I'm questioning it a little bit. I ...
1
vote
1answer
1k views

Linux-KVM / iptables: prevent guest spoofing by matching ip+mac address on bridge?

I have my KVM guests on a standard br0 bridge setup: auto br0 iface br0 inet static address 192.168.1.117 netmask 255.255.255.0 network 192.168.1.1 broadcast 192.168.1.225 gateway ...
1
vote
0answers
63 views

How can I reject mails coming from a fake domain or a fake user in a real domain?

I have an exchange server 2010 recently installed and I receive a test with 3 step to check the security of my server. below the test Check if my server receive from fake domain. Check if my server ...
1
vote
0answers
161 views

Email Spoofed From Exchange Server

One of my exchange users got an email that bounced back to them. They did not send the email and I'm a little confused at how they got it. I looked through the logs and do not see the email leaving ...
1
vote
1answer
6k views

Exchange 2010 email spoofing prevention

Masters, Unfortunately we got some spam mail which seems to be coming from our own domain. I found some article which all says to remove Anonymous login from internet receive connector ...
1
vote
0answers
915 views

Woes with named/bind and forwarding zones

I'm sadly restricted to a very old version of bind (9.4.2) This is the think. If I setup bind with a named.conf and only forwarding it works perfect. acl clients { any ; }; options { ...
1
vote
1answer
189 views

Bingbot spoof localhost ip

So here is a fun one. I'm getting bingbot requests at a certain time everyday that kill the server. Here is the request: 127.0.0.1 - - [14/Sep/2013:08:18:49 -0500] "GET / HTTP/1.1" 200 82810 "-" ...
1
vote
1answer
400 views

Finding spoofed IP address on network

I have a few IP spoof dropped messages coming out of my Sonicwall firewall, we'll call them Source A and Source B. Both of these sources have the same mac address indicating they're coming from the ...
0
votes
3answers
3k views

Exchange and SPF Records

I've created an SPF record on 123-Reg, which is working great. But my question is how Exchange servers know that an SPF record exists when they receive mail from a domain. How does Exchange know it ...
0
votes
3answers
103 views

How to scan for which ports would be open to another location

I'm just assessing the security of my home server in preparation for opening it up to the internet. I've used nmap from a machine on my local network but I have firewall rules allowing access from the ...
0
votes
1answer
244 views

iptables: is it possible to spoof NEW packets and make them look like ESTABLISHED packets?

See title for the question. This question relates to a previous question wherein I asked the difference between NEW,ESTABLISHED and RELATED , see it here iptables: difference between NEW, ESTABLISHED ...
0
votes
1answer
369 views

Counter MAC Spoofing with Cisco

I was wondering if someone could help me with the needed cisco commands to configure a switch to only allow certain mac addresses on certain ports. So that one mac adres can only connect to the ...
0
votes
1answer
516 views

Tracking anonymous e-mail threat

A user spoofed/sent an email from http://emkei.cz/ with a very serious threat. Is it possible to trace this back or are we SOL? There wasn't much in the email headers other than that it came from ...
0
votes
1answer
359 views

Banner Grabbing Spoofing

I run a windows server 2008 standard R2. Is there a way to spoof the server banner ? So instead of Microsoft-IIS/7.5 it could be anything.
0
votes
2answers
305 views

My exchange 2003 mail server is blocked by RBL lists. Someone is sending spam from inform@mydomain.com

All outgoing email to external recipients from my Exchange 2003 server is getting blocked by RBL lists. I'm new to administrating Exchange and i checked the Message Tracking Center under System ...
0
votes
1answer
77 views

What will happen in a network if multiple devices have the same MAC address? [closed]

What will happen in something like a wifi connection where different laptops are set with the same MAC address . To make it more interesting what will happen if there are multiple devices with same ...
0
votes
2answers
372 views

Protecting my Bind dns server from slow kaminsky-style cache poisoning attacks

Dan Kaminsky described how DNS servers could be poisoned with spoofed DNS responses [1]. As I understand it, the problem was that Kaminsky found a way to account for most other sources of randomness ...