Geek Speak — HabitableZone

Geek Speak » in reply to internet access account theft?

IP spoofing

Yes, it's possible to impersonate an IP address, with sufficient technical skill. Each packet of data your computer sends out over a TCP/IP network (the Internet's technology, whether on a public or private net) includes your IP address. It's possible to hack deep into the operating system to write a different address in the sender address field of each packet. If the idea is to get the other computer to respond, this would also require hacking a device called a router on the network so that the response packets get sent to the spoofing computer and not to the real computer.

It's also possible for somebody to infect your computer with a virus that sets up a "proxy" on your computer. A proxy would download data from the Aussie sites through your computer and then relay it on to the hacker. In this scenario, the IP address is legitimate, the hacker's address is hidden, and you get blamed as the human responsible for it. A similar technique is being used a lot these days by spammers, who infect computers with email servers, so that spam goes out under the victim's address.

In the first scenario, the IP spoofer would have to be inside the university network for the administrators to see any traffic in their logs. If somebody outside were doing it, data would be flowing directly between the spoofer and the Australian sites, and no trace would show up in the school net.

In the proxy scenario, if the hacker is outside the school network the logs should show a corresponding amount of data leaving the school network within milliseconds of the inbound traffic. If the hacker is inside, then there'd be no log of outbound traffic.

To detect the first scenario, the network administrators would have to monitor the network for a few days with a device called a "packet sniffer". Sniffers record all data associated with addresses (be careful what you do on the Net during this period!). It's not widely known, but there's a deeper address also encoded in the packets, called a "MAC address" (not Macintosh, but "Media Access Control"), which is a unique address assigned to every piece of network interface hardware. It's much harder to forge since it's burnt right into the network card. If they see packets with your IP address but a different MAC address, they've found IP spoofing.

To look for the second scenario, be sure your antivirus software is up-to-date, and scan for it. Also, get a personal firewall product like BlackICE, which looks for unusual network activity.

In all scenarios, it might help if you can show that you weren't at your computer at the time of the crime. Classic detective-show stuff: You have to establish an alibi.

I just deleted a paragraph about dynamically-assigned addresses. You've had a consistent address for several days, as recorded at the bottom of the posts, so your network is not using "DHCP". Just thought I'd cover that base in case somebody brings it up.

I just did a thing called a traceroute, which follows packets through the Internet between me and the IP address recorded for you. Oddly enough, they went to Australia. I read into your post, perhaps presuming too much, that you aren't in Australia. If you'd like to send me a private email disclosing your location, maybe we can clear that up. If you're not in Australia, then somebody's definitely hacked into the infrastructure of the Internet.

I know I didn't bring clarity and resolution to the problem. But it's a genuinely gnarly situation. Maybe if you talk to the network geeks about some of this, it'll help you and them get to the bottom of it. Good luck.

Log in or register to post.

The whole thread (11 posts)