title: Application Security Concerns: How easy is it to fake an IP-Address?
body: <p>I am dealing with an application that is protected by a firewall and only allows access from certain IP-Addresses (which are application webservers).</p>
  
  <p>Its a bit delicate and it would be much hassle to introduce another authentication/protection layer.</p>
  
  <p>My understanding of networking is not great because its not my subject, but in my Head I made up the following scenario:</p>
  
  <ul>
  <li><p>Someone knows the IP-Address of one of our application servers and wants to fake it to get access to the other application which he knows the listening socket and protocol of.</p></li>
  <li><p>So he alters the Header of his IP packets to have the Webserver IP as transmitter.</p></li>
  </ul>
  
  <p><em>What happens next?</em></p>
  
  <ul>
  <li><p>A: His ISP rejects the packet and says "Hey, that is not the IP address you were assigned from me." - Problema Solved</p></li>
  <li><p>B: The ISP passes the packet on to the next level (his up-link...)</p></li>
  </ul>
  
  <p>Lets assume the ISP has been compromised or the packet is passed on without inspection (I don't know whether that's the case)</p>
  
  <p><em>What happens next?</em></p>
  
  <ul>
  <li><p>A: The carrier rejects the Packet and says "Hey, that IP is not in the range of IP we agreed you are operating on!" - Now if my webserver isnt operated by the same ISP that my attacker compromised - Problema solved</p></li>
  <li><p>B: The ISP doesn't inspect the packet or is compromised and forwards it to his up-link.</p></li>
  </ul>
  
  <p>Now I am quite sure that IP addresses ARE inspected and filtered when passing a router. Otherwise it would be total anarchy.</p>
  
  <p>So to put this straight: An Attacker that wants to fake my IP-Address needs to compromise the VERY same ISP that is in charge of the IP-Range my Webserver operates in - or this ISP does not do packet inspection.</p>
  
  <ul>
  <li>Is this correct?</li>
  </ul>
  
  <p>Okay now I imagine my server is located in an office and its ISP is a regional cable company.</p>
  
  <p>What would be the steps necessary to send packets from my IP address to another internet IP?</p>
  
  <p>(Of course I am only asking to get aware of the risks and choose proper protection!)</p>
  
  <p>I imagine locating the routing station which is often in some small container at the side of the street that is only protected by a lock. Going in there. Swapping cables or plugging yourself into. </p>
  
  <p>Will this most likely work if you know what you are doing or is there some encrypted handshake with keys stored on the real offices modem that is required to built an authenticated connection?</p>
  
  <p>I am talking about today's standards in cable internet.</p>
  
  <p>Last thought: So if my origin server is not some household ISP that has its stations vulnerable on the street i should be pretty safe, right?</p>
  
  <p>I remember that NFS servers relies on IP authentication ONLY as a default. Because this is pretty common - are there any examples where NFS servers got hacked by faking IP addresses?</p>
  
  <p>I realise that this question is put very very vagly. This is because I am not sure about anything I am saying here. I just wanted to give some input where I think the cave-eats could be, so they can be confirmed or eliminated.</p>
  
  <p>Overall I am grateful for any comment and your personal thoughts about that subject!</p>