Subject: RE: IP Address spoofing

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 18 Aug 2004 17:57:41 -0700

> I understand this is not easy to do.  My concern is the degree of
> difficulty/expense it takes to do so.  I saw one vendor who claims to
> have a sample, fraudulent message claiming to be from US Bank 
> where the
> IP address was spoofed.

It is a viable small scale attack, it is not a viable large scale 
attack.

There are basically two types of IP spoofing, one is asymmetric
routing which requires the assistence of the IP address being 
spoofed and is not relevant in the Sender-ID context.

The second method is various routing compromises. These are certainly
possible but unlikely to be persistent. Injecting fake routes for
IP blocks in use is not a very easy crime to get away with.