Journal CmderTaco's Journal: Someone's trying to hack my account! 5
Hi.
Some lifeless people have been trying to hack into my account (is it GNAA?). Look what kind of email I received:
Your new password is toiDiUoY. Your old password will still work until
this password is used. Go to the URL below to log in:Make sure you then CHANGE YOUR PASSWORD!
If you have received this message without having requested it, it is because someone attempted to use your username or e-mail address. It was mostly likely an innocent mistake, and they are not getting your password, so you can safely disregard this message.
Thanks.
In case you get multiple emails you didn't request, the requester's IP
was 4.245.48.149. Its user agent was
"Mercatur/6.9 (Lunix; Q; MercaturOS 6.6.6; en-EU; rv:1.234) G"
(not that you should trust that value, but it might be interesting).
It's not a fake email - it was indeed sent to me from Slashdot, using an email address which is known only to Slashdot and me.
See the spoofed IP. It's very interesting - how could you feed a webserver with a fake IP like that? It doesn't make sense. Also it's nice to see that the hackers are using lunix.. and could anyone would tell me what's the deal with Mercatur? Is it a girl or something more than that?
IP spoofing over TCP/IP (Score:1)
As you note, it's moderately difficult to spoof one's IP over TCP/IP, at least compared to UDP. Whereas in UDP, you only have to fill in a fake address once, and you don't care about the response, TCP/IP has a handshake [everything2.com]. You have to pass a SYN to the server, the server passes a SYN/ACK back to you, and then you ACK, and you send your request. Now each of these messages has to make reference to a number identifying the previous packet. And if you spoof your IP, you don't get the ACK, so you don't know t