This Activity Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) and Pre-ATT&CK frameworks. See the MITRE ATT&CK for Enterprise and Pre-ATT&CK frameworks for referenced threat actor techniques.
Attributing malicious cyber activity that uses network tunneling and spoofing techniques to a specific threat actor is difficult. Attribution requires analysis of multiple variables, including location. Because threat actors can use these techniques to obfuscate their location, it is not possible to identify the true physical location of malicious activity based solely on the geolocation of Internet Protocol (IP). This Alert discusses how threat actors use these obfuscation techniques to mislead incident responders.
The geolocation of an IP address is often obtained with publicly available information (WHOIS registration) or proprietary information. The level of geographic precision varies widely across sources; some provide country and locality details, while others provide neighborhood-level detail. Additionally, the accuracy of this information varies by source.
However, even if the geolocation of an IP address is accurate, the threat actor may not be physically located near it; instead, they may be hiding their true location through the use of spoofing and network tunnels.
A threat actor can spoof packets with an arbitrary source IP address, which in turn geolocates to a specific country (see figure 1). The actor’s physical location may be elsewhere. The actor then initiates their malicious activity. Network defenders see packets originating from a source IP address that did not generate the traffic. This technique is most common with connectionless activities, such as distributed Endpoint Denial of Service [T1499] and Network Denial of Service [T1498]— including DNS amplification—attacks.
Figure 1: IP spoofing
A network tunnel encapsulates network traffic between two points (see figure 2). Often network tunnels are used for legitimate purposes, such as secure remote administration or creating virtual private networks (VPNs). However, a malicious cyber actor can use this technique to mask their true source IP address and, therefore, their physical location. The threat actor accomplishes masking by using virtual private servers (VPSs), which can be purchased through commercial providers. The threat actor will initiate a remote network tunnel from their computer to the VPS and then use the VPS to initiate malicious activity. Network defenders see the IP address, as well as geolocation information of the VPS. Attempts to identify the cyber actor’s physical location by using the geolocation of the VPS will be inaccurate. Network tunneling is common with malicious _Connection Proxy _[T1090] activities.
Figure 2: Network tunnel encapsulation
The ease with which IP addresses can be spoofed and the possibility that activity could be tunneled through a network to intentionally mask the true source prevents any attempt to identify the physical location of the activity based solely on the geolocation of the IP address.
In addition to being knowledgeable about threat actor obfuscation techniques, CISA encourages incident responders to review the following best practices to strengthen the security posture of their systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.
Sign up to receive CISA’s alerts on security topics and threats.
Sign up for CISA’s free vulnerability scanning and testing services to help organizations secure internet-facing systems from weak configuration and known vulnerabilities. Email [email protected] to sign up. See <https://www.cisa.gov/cyber-resource-hub> for more information about vulnerability scanning and other CISA cybersecurity assessment services.
Palo Alto Networks and IBM contributed to this Alert.
Cloudflare Blog: The real cause of large DDoS - IP Spoofing
Cisco Configuration Guide: Implementing Tunnels
July 16, 2020: Initial Version
attack.mitre.org/versions/v7/matrices/enterprise/
attack.mitre.org/versions/v7/techniques/pre/
attack.mitre.org/versions/v7/techniques/T1090/
attack.mitre.org/versions/v7/techniques/T1498/
attack.mitre.org/versions/v7/techniques/T1499/
blog.cloudflare.com/the-root-cause-of-large-ddos-ip-spoofing/
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
public.govdelivery.com/accounts/USDHSUSCERT/subscriber/new
twitter.com/CISAgov
twitter.com/intent/tweet?text=Malicious%20Cyber%20Actor%20Use%20of%20Network%20Tunneling%20and%20Spoofing%20to%20Obfuscate%20Geolocation+https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-198a
whois.icann.org/en/about-whois
www.cisa.gov/cyber-resource-hub
www.cisco.com/c/en/us/td/docs/ios/12_4/interface/configuration/guide/inb_tun.html
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-198a&title=Malicious%20Cyber%20Actor%20Use%20of%20Network%20Tunneling%20and%20Spoofing%20to%20Obfuscate%20Geolocation
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-198a
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-198a
www.us-cert.gov/ncas/tips/ST04-002
www.us-cert.gov/ncas/tips/ST04-006
www.us-cert.gov/ncas/tips/ST04-010
www.us-cert.gov/ncas/tips/ST18-271
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Malicious%20Cyber%20Actor%20Use%20of%20Network%20Tunneling%20and%20Spoofing%20to%20Obfuscate%20Geolocation&body=www.cisa.gov/news-events/cybersecurity-advisories/aa20-198a