Firewalls, proxy servers, demilitarized zones (DMZ) – companies are increasingly deploying tactics like these to protect their private networks from the dangers of the internet. But not all attacks come from the outside. The weakest link in the chain of network security is the Local Area Network (LAN). An attacker who is already inside the network has countless ways available to them to view data traffic and manipulate it at will. Internal attackers use the vulnerability of the ARP protocols. This is used with the IPv4-based Ethernet networks to resolve IP addresses to MAC addresses, presenting security problems to administrators.
ARP entries can easily be manipulated using falsified data packets. These cases are referred to using the term ARP spoofing, a man-in-the-middle attack that enables hackers to switch unnoticed between two communicating systems. Here we show how the address resolution can be specifically manipulated via ARP and suggest possible countermeasures.
ARP spoofing (also known as ARP poisoning) describes man-in-the-middle attacks carried out on local network ARP tables. This form of attack results in hackers sending out fake ARP packets that slide in between two communicating systems unnoticed so they can listen to or manipulate their data traffic.
Unlike devices on the internet, devices in the LAN don’t communicate directly via IP addresses. Instead, they use physical hardware addresses for addressing in local IPv4 networks. These MAC addresses (Media Access Control) are unique 48-bit numbers, and make it possible to identify each device in the LAN via its network card.
Example of a MAC address: 00-80-41-ae-fd-7e
MAC addresses are assigned by their respective hardware manufacturers and are unique worldwide. Theoretically, these hardware addresses would be suitable for global addressing. But in practice, this doesn’t work because IPv4 addresses are too short to completely map the MAC address. In networks based on IPv4 the address resolution via ARP is unavoidable.
If Computer A wants to contact Computer B within the same network, it must first determine the appropriate MAC address for its IP address. This uses the Address Resolution Protocol (ARP), a network protocol that operates according to the request response scheme.
After searching for the appropriate MAC address, Computer A sends a broadcast request (or ARP request) to all devices on the network. This request contains the following information:
A computer with the MAC address xx-xx-xx-xx-xx-xx and the IP address yyy.yyy.yyy.yyy would like to get in contact with a computer with the IP address zzz.zzz.zzz.zzz and requires the appropriate MAC address.
The ARP request is received by all computers in the LAN. In order to prevent an ARP request from being submitted prior to the sending of each data packet, every computer in the network performs a local table, called the ARP cache. In these tables, all known MAC addresses are temporarily stored along with their matching IP addresses.
In this way, all computers in the network record the broadcast request along with the accompanying sender address. An answer to the broadcast request is only expected from Computer B. Its ARP reply contains the following information:
This is the system with the IP address zzz.zzz.zzz.zzz. The requested MAC address is aa-aa-aa-aa-aa-aa.
If this ARP reply is delivered to Computer A, then it has all of the information required to send data packets to Computer B. Communication over the local network is now not prevented by anything.
What then, if the intended computer doesn’t reply, but instead the reply comes from another device controlled by an internal attacker with criminal intentions? This is where ARP spoofing comes into play.
The request response scheme of ARP protocols is arranged so that the first answer to an ARP request is accepted and stored. In the context of ARP spoofing, hackers try to preempt the actual target computer in order to send a reply packet with incorrect information and manipulate the ARP table of the inquiring computer. This is referred to as ARP poisoning, or a “contamination” of the ARP caches. As a rule, these data packets contain the MAC address of a network device being controlled by hackers. The targeted system then links the output IP to the wrong hardware address and sends all future data packets to the hacker-controlled system. This system now has the opportunity to record or manipulate all data traffic.
To remain undetected, the intercepted data traffic is usually passed on to the actual target system. A hacker then becomes a man in the middle. If the intercepted data packets are not forwarded, but are instead discarded, ARP spoofing can result in a denial of service (DoS). ARP spoofing functions both in LAN and WLAN environments. Even the encryption of wireless networks via Wi-Fi Protected Access (WPA) offers no protection. In order to communicate in local IPv4 networks, all connected devices must resolve MAC addresses – which can only be done via ARP.
One well-known software that lurks specifically on broadcast requests and responds with fake ARP replies is Cain&Abel. But to ‘contaminate’ the ARP cache of a network device, a hacker doesn’t necessarily need to wait on ARP requests. Another strategy includes continually bombarding the network with false ARP replies. While most systems ignore answer packets that can’t be assigned to a request, this changes as soon as a computer in the LAN starts an ARP request and so is willing to receive a response. Depending on timing, either the response of the target system or one of the fake response packets will arrive at the sender first. This attack pattern can be automated by programs such as Ettercap.
Programs that operate in the framework of ARP spoofing as hacking software are usually presented as security tools and are available for free online. Administrators can use the programs to test their network and protect against common attack patterns. The most common applications are ARP0c/WCI, Arpoison, Cain&Abel, Dsniff, Ettercap, FaceNiff, and NetCut.
If a hacker succeeds in switching between two communication partners, they have free rein over the unprotected connections. Because the entire communication of a hacked connection runs through the system of the hacker, they can read and manipulate the data at will. Protection against data espionage can be promised by some encryption techniques and certificates for authentication. If an attacker only catches encoded data, the worst case is limited to a denial of service by discarding data packets. But reliable data encryption has to be implemented consistently.
Numerous tools that can be used for the purpose of man-in-the-middle attacks provide ARP spoofing functions as well as client and server implementation for SSL/TLS, SSH and other encryption protocols. These have the ability to imitate appropriate certificates and establish encrypted connections. Cain&Abel, for example, simulates a SSL-capable webserver, which then sends an untrustworthy SSL-certificate to the victim system. Admittedly, network users are warned in this case, but these warnings are usually either ignored or misinterpreted by the user, so lessons on the subject of network security should also cover the responsible handling of digital certificates.
Since ARP spoofing exploits the address resolution protocol, all IPv4 networks are prone to attacks of this kind. The implementation of IPv6 was also unable to solve this core problem. The new IP standard renounces ARP and instead controls address resolution in the LAN via NDP (Neighbor Discovery Protocol), which is also vulnerable to spoofing attacks. The security gap could be closed through the Secure Neighbor Discovery (SEND) protocol, but this isn’t supported by many desktop operating systems.
Possible protection from the manipulation of ARP caches is offered by static ARP entries, which can be set in Windows, for example, by using the command line program ARP and the command arp –s. But since entries of this type have to be made manually, these security methods are generally restricted to only the most important systems in the network.
A further measure against the abuse of ARP is the division of networks into Layer 3 switches. Uncontrolled, broadcast requests reach only the systems that are in the same network segment. ARP requests in other segments are checked by the switch. If they work on the network layer (Layer 3) then the IP address is matched with both the MAC address and the previous entries. If there are any discrepancies or frequent reassignments, the switch alarm will sound. But the required hardware is quite expensive. Administrators have to gauge whether the boost in security justifies the financial expense. On the other hand, the significantly more favorable Layer 2 switches that work on the data link layer are not adequate. Although they register a change in the MAC address, the assignment to the respective IP address remains unaffected.
Numerous software manufacturers offer monitoring programs that can supervise networks and detect suspicious ARP processes. Well-known tools are the open-source software Arpwatch, as well as ARP-Guard and XArp. In addition, intrusion detection systems such as Snort can be used to monitor address resolution via ARP.
The intrusion detection system (IDS) Snort also operates using an integrated arpspoof preprocessor, which enables it to monitor data traffic in the network and manually compile comparison lists. But this is comparatively expensive.
More importantly, IDS is mostly only used for the transition to external networks. Whether the use with the LAN counts must be decided on an individual basis. Occasionally such measures are opposed by the works council. An administrator who monitors the network via IDS has access to the entire network and so can also monitor all activities of the company’s employees – as a result, the control function is available but generally not desired.
Sending data over networks is one of the most important and highest utilized functions of the modern computer era. But the structure of the necessary TCP/IP connections makes it all too easy for criminals to intercept data packets along their way and either view or alter their contents. One of the most common methods of attack is IP spoofing, which allows DoS and DDoS attacks, among other things...
MAC spoofing is a method by which unique hardware addresses are masked using a Locally Administered Address (LAA) in the software. MAC spoofing can offer protection for your privacy when using public LAN or WLAN networks, but can also be used for illegal network activities. We explain to you here how MAC spoofing works and which settings in Windows must be accessed in order to change your MAC...
Out-dated technology can still be interesting. Even though the Reverse Address Resolution Protocol was introduced in 1984, and considered obsolete the following year due to the Bootstrap Protocol, it continued to be used long after. The RARP has not completely disappeared from network technology even today. As the Reverse ARP, this protocol is a counterpart to the Address Resolution Protocol. But...
DNS spoofing involves tampering with DNS name resolution. This kind of attack poses a serious threat to internet users. Here you will learn how the different types of attack methods work, which targets attackers go after, and what you can do to effectively protect yourself.
Spoofing attacks encompass a wide range of potential attack scenarios. Besides conventional approaches like IP spoofing and DNS spoofing, they also include particularly dangerous phishing attacks. Read this article to find out how spoofing attacks work and what measures you can take to protect yourself effectively.
Provide powerful and reliable service to your clients with a web hosting package from IONOS.
View packages
