IP Spoofing In and Out of the Public Cloud: From Policy to Practice

Abstract

In recent years, a trend that has been gaining particular popularity among cybercriminals is the use of public Cloud to orchestrate and launch distributed denial of service (DDoS) attacks. One of the suspected catalysts for this trend appears to be the increased tightening of regulations and controls against IP spoofing by world-wide Internet service providers (ISPs). Three main contributions of this paper are (1) For the first time in the research literature, we provide a comprehensive look at a number of possible attacks that involve the transmission of spoofed packets from or towards the virtual private servers hosted by a public Cloud provider. (2) We summarize the key findings of our research on the regulation of IP spoofing in the acceptable-use and term-of-service policies of 35 real-world Cloud providers. The findings reveal that in over 50% of cases, these policies make no explicit mention or prohibition of IP spoofing, thus failing to serve as a potential deterrent. (3) Finally, we describe the results of our experimental study on the actual practical feasibility of IP spoofing involving a select number of real-world Cloud providers. These results show that most of the tested public Cloud providers do a very good job of preventing (potential) hackers from using their virtual private servers to launch spoofed-IP campaigns on third-party targets. However, the same very own virtual private servers of these Cloud providers appear themselves vulnerable to a number of attacks that involve the use of spoofed IP packets and/or could be deployed as packet-reflectors in attacks on third party targets. We hope the paper serves as a call for awareness and action and motivates the public Cloud providers to deploy better techniques for detection and elimination of spoofed IP traffic.

Internet of things: Digital footprints carry a device identity

“…Conventionally, internet protocol (IP) enabled devices have been using user-defined identifiers, such as IP and media access control (MAC) addresses, as a form of identifications. However, these identifiers have been proven to be vulnerable [3] to various attacks, such as spoofing [4] and device mobility, due to the availability of malicious software [5] , for performing such attacks. Device fingerprinting (DFP) [3] represents one technique that may be used to identify devices based on their communication traffic traces (or digital footprints) without using explicit identifiers, and it can be performed, either actively or passively, from different layers of the communication model [6] .…”