Tom Lowe wrote:
Hi all.
I have a "security" question regarding "trusted IP's". Is it possible for someone to SUCCESSFULLY spoof an IP and actually make working calls?
For example, '10.10.10.10' sends calls to SER (or any other proxy server) at 20.20.20.20, but actually spoofs the IP by sending an IP address of 30.30.30.30, which happens to be trusted by the SER at 20.20.20.20.
It is possible to successfully spoof an IP using ARP poisoning by someone with access to the local network. This could not be detected from SER because responses would actually be routed to the attacker. ARP poisoning hijacks an IP address at the link layer. Here are two articles that describe it and how to detect it and to protect against it:
http://www.watchguard.com/infocenter/editorial/135324.asp http://www.sans.org/rr/whitepapers/threats/474.php
Non-local attackers could get SER to deliver SIP messages for them by sending UDP/SIP packets with forged source IP addresses, but the attacker would not receive the responses and so should not be able to complete the INVITE/OK/ACK transaction unless they can predict the connection and header values that would be provided by the callee. If the trusted IP addresses are local, these SIP messages could be detected and dropped by an ingress filter that packets entering the network do not have source IP addresses within the network.
Hope this helps,
Jamey