ARP Spoofing

• Promiscuous Mode

Overview

ARP poisoning involves forging many ARP request and reply packets to overload a Switch

• ARP cache poisoning is the method of attacking a LAN network by updating the target computer's ARP cache with both forged ARP request and reply packets designed to change the Layer 2 Ethernet MAC address (that of the network card) to one that the attacker can monitor
• Attackers use ARP poisoning to sniff on the target network
• Attackers can thus steal sensitive information, prevent network and web access, and perform DOS and MiTM attacks

Attack Mechanism

ARP resolves IP addresses to the MAC (Hardware) address of the interface to send data. ARP packets can be forged to send data to the attacker's machine. ARP spoofing involves constructing a large number of forged ARP request and reply packets to overload a switch. When a machine sends an ARP request, it assumes that the ARP reply will come from the right machine. ARP provides no means of verifying the authenticity of the responding device. Even systems that have not made an ARP request can accept the ARP replies coming from other devices.

Attackers use this flaw in ARP to create malformed ARP replies containing spoofed IP and MAC addresses. Assuming it to be the legitimate ARP reply, the victim's computer blindly accepts the ARP entry into its ARP table. Once the ARP table is flooded with spoofed ARP replies, the switch is set in forwarding mode, and the attacker intercepts all the data that flows from the victim's machine without the victim being aware of the attack. Attackers flood a target computer's ARP cache with forged entries, which is also known as poisoning. ARP spoofing is an intermediary for performing attacks such as DoS, MITM, and session hijacking.

ARP spoofing is a method of attacking an Ethernet LAN. When a legitimate user initiates a session with another user in the same layer 2 broadcast domain, the switch broadcasts an ARP request using the recipient's IP address, while the sender waits for the recipient to respond with a MAC address. An attacker eavesdropping on this unprotected layer 2 broadcast domain can respond to the broadcast ARP request and replies to the sender by spoofing the intended recipient's IP address. The attacker runs a sniffer and turns the machine's NIC adapter to promiscuous mode.

Attack Flow Diagrams

sequenceDiagram
    participant Attacker
    participant Victim
    participant Router

    Attacker->>Victim: Send spoofed ARP reply (IP of Router -> MAC of Attacker)
    Victim->>Attacker: Updates ARP cache with incorrect MAC address for Router
    Attacker->>Router: Send spoofed ARP reply (IP of Victim -> MAC of Attacker)
    Router->>Attacker: Updates ARP cache with incorrect MAC address for Victim
    Attacker->>Victim: Man-in-the-middle: Intercepts and forwards traffic
    Attacker->>Router: Man-in-the-middle: Intercepts and forwards traffic

graph LR
    V["Victim
192.168.1.100
MAC: aa:bb:cc:dd:ee:ff"]
    G["Gateway/Router
192.168.1.1
MAC: 11:22:33:44:55:66"]
    A["Attacker
192.168.1.50
MAC: xx:xx:xx:xx:xx:xx"]
    
    V -.->|"1 ARP Request: Who has 192.168.1.1?"| G
    G -.->|"2 ARP Reply: I am 192.168.1.1"| V
    A -->|"3 Fake ARP Reply: I am 192.168.1.1"| V
    V -->|"4 Updates ARP cache with attacker MAC"| V
    V -->|"5 All traffic intended for gateway"| A
    A -->|"6 Forwards traffic to real gateway"| G
    G -->|"7 Gateway replies via attacker"| A
    A -->|"8 Attacker intercepts and forwards"| V
    
    classDef victim fill:#ffebee,stroke:#c62828,stroke-width:2px
    classDef gateway fill:#e8f5e8,stroke:#2e7d32,stroke-width:2px
    classDef attacker fill:#fff3e0,stroke:#ef6c00,stroke-width:2px
    
    class V victim
    class G gateway
    class A attacker

ARP Poisoning

The result of ARP spoofing, where the ARP cache is poisoned with incorrect IP-to-MAC mappings.

Tools

• ettercap
• Cain and Abel

Technical Background

The term ARP Spoofing, also widely known as ARP Poisoning or ARP Cache Poisoning, refers to a type of active network attack that exploits vulnerabilities in the Address Resolution Protocol (ARP) to redirect network traffic, primarily for sniffing or launching Man-in-the-Middle (MITM) attacks.

ARP poisoning is listed as a network hacking technique and a sniffing technique used by attackers to steal and manipulate sensitive data and gain control over a target network.

Address Resolution Protocol (ARP) Background

ARP is a fundamental, stateless TCP/IP protocol.

• Function: ARP is responsible for mapping IP network addresses (Layer 3) to the corresponding MAC (hardware) addresses (Layer 2) of devices on a local network segment.
• ARP Cache: Host machines maintain an ARP table or ARP cache that stores IP-to-MAC address mappings.
• The Flaw: ARP is stateless, meaning a machine can send an ARP reply even if no corresponding ARP request was sent. Critically, ARP provides no means of verifying the authenticity of the responding device, and receiving systems often blindly accept these unsolicited ARP replies and update their cache.

ARP Spoofing Attack Mechanism

ARP spoofing leverages the inherent trust mechanism of the ARP protocol to insert the attacker's machine into the communication path.

1. Forging Packets: The attacker constructs and sends a large number of forged ARP request and reply packets onto the Local Area Network (LAN).
2. Poisoning the Cache: These malformed packets contain spoofed IP and MAC addresses. The attacker floods a target computer's ARP cache with these entries (hence, "poisoning").
3. Redirection: The attacker typically aims to associate their machine's MAC address with the IP address of a critical host, such as the default gateway or another victim.
4. Traffic Interception: The victim's computer, assuming the forged entry is legitimate, updates its ARP table. Consequently, traffic destined for the gateway (or the other victim) is now routed through the attacker's system instead.
5. Environment: ARP spoofing is a common method of active sniffing used against switched Ethernet networks. Once the ARP table is flooded with spoofed replies, the switch may be set in forwarding mode, allowing the attacker to sniff all network packets. To execute the attack, the attacker runs a sniffer with the Network Interface Card (NIC) set to promiscuous mode.

Goals and Threats of ARP Poisoning

ARP poisoning is used as a foundation for several serious attacks:

• Man-in-the-Middle (MITM) Attacks: The primary consequence is establishing an MITM position where the attacker secretly relays and possibly alters communication between two parties who believe they are communicating directly.
• Packet Sniffing and Data Theft: By diverting traffic, the attacker can sniff and intercept data packets containing sensitive information such as usernames and passwords in clear text.
• Session Hijacking: ARP spoofing is an intermediary step for performing session hijacking. If the attacker is on the local segment, they can poison the ARP caches of the two legitimate hosts participating in a TCP session to route the traffic back to themselves, aiding in hijacking non-encrypted TCP communications.
• DNS Spoofing (Intranet): ARP poisoning can be used to redirect the DNS requests of clients to an attacker's machine, enabling Intranet DNS Spoofing. The attacker can then send a fake DNS response redirecting the client to a malicious website.
• Denial-of-Service (DoS) Attacks: ARP spoofing can facilitate DoS by overloading the target host with traffic, such as by linking multiple IP addresses to a single target MAC address, or by associating a non-existent MAC address to the IP address of the gateway.

Attack Tools

Attackers commonly use specialized tools to automate the generation of forged ARP replies:

• arpspoof: This utility redirects packets by forging ARP replies. It is described as an extremely effective way of sniffing traffic on a switch.
• Ettercap: Used to identify MAC addresses of clients and routers and perform ARP poisoning and MITM attacks.
• BetterCAP: A framework offering ARP spoofers for MITM attacks on IPv4 and IPv6 networks.
• Habu: A hacking toolkit providing commands to perform ARP poisoning and sniffing.
• Other tools include RITM, ARP Spoofer, and larp.

Countermeasures and Detection

Prevention (Countermeasures)

• Dynamic ARP Inspection (DAI): This is a key security feature on switches that prevents ARP poisoning. DAI validates ARP packets against the information stored in the DHCP snooping database. If the MAC address or IP address in the ARP packet does not match a valid entry, the packet is dropped. DHCP snooping must be enabled before DAI.
• IP Source Guard: This security feature restricts IP traffic on untrusted Layer 2 ports by filtering traffic based on the DHCP snooping binding database, preventing spoofing attacks where the attacker spoofs another host's IP address.
• Static ARP Entries: Permanently adding the MAC address of the gateway to the ARP cache is a defense mechanism. If host systems use static IP addresses, static mapping (associating an IP to a MAC address on a VLAN) should be performed.
• Encryption: Using secure versions of communication protocols (such as HTTPS, SFTP, and SSH) that offer encryption and authentication helps protect traffic against sniffing that results from ARP poisoning.

Detection

• Manual ARP Cache Check: Users can check their ARP table in the command prompt (arp -a). If the table contains two different IP addresses that share the same MAC address, this indicates an ARP poisoning attack.
• Monitoring Tools: Security professionals use tools like Capsa Portable Network Analyzer, Wireshark, OpUtils, netspionage, NetProbe, and ARP-GUARD to detect ARP poisoning and flooding attacks.
• IDS/IPS: Intrusion Detection Systems (IDS) can be run to note whether the MAC addresses of certain machines (like the router's MAC address) have changed, which is an indicator of suspicious activity.