Dataplane.org Newsletter • 1 HN point • 05 Mar 24
- A new technique called Destination-Adjacent Source Address Spoofing (DASA) was observed where source IP addresses were faked to a neighbor address of the target, potentially for unique Internet surveying or experimental purposes.
- The DASA spoofed addresses were noticed in DNS queries, showing unusual patterns like using IPv4 addresses in hex format and inconsistent query domains over time.
- Through Source Address Spoofing Triangulation, attempts were made to pinpoint the true origin of the spoofed packets, suspecting an academic institution in China, showing the potential to uncover interesting insights using network intelligence.