WEBVTT 00:00.490 --> 00:01.000 Yes. 00:01.000 --> 00:09.190 We're going to have an entire chapter dedicated to evading things like firewalls and other security 00:09.190 --> 00:09.850 devices. 00:09.850 --> 00:12.580 But we need to get into that a little bit right now. 00:12.910 --> 00:21.850 You see, there is a common method of evading firewalls and IPS devices and IDS devices, and one of 00:21.850 --> 00:23.740 those is IP spoofing. 00:23.920 --> 00:26.290 And we need to talk about that in this context. 00:26.560 --> 00:31.480 This is often the technique that will be used during reconnaissance phases. 00:31.810 --> 00:39.370 So like I said, even though we're going to have a chapter dedicated to evading security devices, understand 00:39.370 --> 00:46.960 that users or attackers, I should say, will often have a decoy IP address that they use, or they 00:46.960 --> 00:55.690 will spoof an address so they will change their IP address, their source IP, so that it is one permitted 00:55.690 --> 00:59.860 by your firewalls or other type of security devices. 01:00.280 --> 01:02.260 This is a major problem. 01:02.260 --> 01:04.210 And we'll talk about mitigations in a moment. 01:04.810 --> 01:10.720 Now, understand that there's plenty of other ways they're going to try and get their reconnaissance 01:10.720 --> 01:14.500 traffic around your security devices like fragmentation. 01:14.860 --> 01:17.370 Source routing is a big no no. 01:17.380 --> 01:24.670 Typically, this is where they can dictate which hops the packet is going to take, manipulating their 01:24.670 --> 01:31.870 source port so that it looks like valid traffic customizing packets randomizing their host scan so it's 01:31.870 --> 01:35.380 less often detected sending bad check sums. 01:35.530 --> 01:37.600 These are all methodologies. 01:38.110 --> 01:39.370 But the ability. 01:39.610 --> 01:40.870 Proxy servers. 01:40.870 --> 01:41.230 Yeah. 01:41.260 --> 01:49.510 Proxy servers being used or anonymize was another type of proxy where the entire purpose of the proxy 01:49.720 --> 01:55.090 is to disguise the identity of the individual. 01:55.270 --> 02:02.050 So anonymous users here are big time utilized so that the people that are attacking us can stay anonymous 02:02.080 --> 02:03.580 or try and stay anonymous. 02:04.390 --> 02:14.500 So when it comes to IP spoofing countermeasures, we want to avoid trusting other network entities and 02:14.500 --> 02:19.360 therefore having to allow their IP address space into our private networks. 02:19.630 --> 02:26.830 We want to make sure firewalls and filters are tuned to only permit valid traffic in. 02:27.190 --> 02:37.900 And here's the deal because IP spoofing is a reality because someone can show up with the what appears 02:37.900 --> 02:39.820 to be correct IP address. 02:40.180 --> 02:45.070 We cannot rely on IP based authentication alone. 02:45.400 --> 02:48.610 Just think about the power of multi-factor authentication. 02:48.760 --> 02:57.460 Would you ever want to say to some node, oh, I see you're at ten, ten, 10.100, so that's fine. 02:57.910 --> 02:58.510 Come on in. 02:58.900 --> 03:05.770 Now, we would never rely on the IP address as the only source of authentication. 03:06.040 --> 03:13.210 We would make that individual prove something else as far as identity goes because of the common spoofing 03:13.210 --> 03:14.300 of IP addresses. 03:14.710 --> 03:20.380 Also, another great countermeasure is the randomization of initial sequence numbers, which is done 03:20.380 --> 03:26.740 by most operating systems now just as a default built in security protection mechanism. 03:27.400 --> 03:36.010 So yes, we might see spoofing and other tricks to try and make this reconnaissance possible or undetected. 03:36.220 --> 03:41.980 We know there's going to be powerful countermeasures against such activities, thank goodness.