What is ARP Spoofing attack?
The request response scheme of ARP protocols is arranged so that the first answer to an ARP request is accepted and stored. In the context of ARP spoofing, hackers try to pre-empt the actual target computer in order to send a reply packet with incorrect information and manipulate the ARP table of the inquiring computer. This is referred to as ARP poisoning, or a “contamination” of the ARP caches. As a rule, these data packets contain the MAC address of a network device being controlled by hackers. The targeted system then links the output IP to the wrong hardware address and sends all future data packets to the hacker-controlled system. This system now has the opportunity to record or manipulate all data traffic.
To remain undetected, the intercepted data traffic is usually passed on to the actual target system. A hacker then becomes a man in the middle. If the intercepted data packets are not forwarded, but are instead discarded, ARP spoofing can result in a denial of service (DoS). ARP spoofing functions both in LAN and WLAN environments. Even the encryption of wireless networks via Wi-Fi Protected Access (WPA) offers no protection. In order to communicate in local IPv4 networks, all connected devices must resolve MAC addresses – which can only be done via ARP.
One well-known software that lurks specifically on broadcast requests and responds with fake ARP replies is Cain&Abel. But to ‘contaminate’ the ARP cache of a network device, a hacker doesn’t necessarily need to wait on ARP requests. Another strategy includes continually bombarding the network with false ARP replies. While most systems ignore answer packets that can’t be assigned to a request, this changes as soon as a computer in the LAN starts an ARP request and so is willing to receive a response. Depending on timing, either the response of the target system or one of the fake response packets will arrive at the sender first. This attack pattern can be automated by programs such as Ettercap.
Definition of ARP ARP spoofing (also known as ARP poisoning) describes man-in-the-middle attacks carried out on local network ARP tables. This form of attack results in hackers sending out fake ARP packets that slide in between two communicating systems unnoticed so they can listen to or manipulate their data traffic.
How does the ARP Spoofing attack work?
In a broader perspective, ARP spoofing is meant to steal some data intended for the target victim. Here is a series of usual steps that are part of ARP spoofing:
- The attack is usually launched using some tools.
- The attacker opens an ARP spoofing tool such as ARP spoof, Cain & Abel, AR poison, and Ettercap and sets the IP address of the tool to match the IP subnet of the victim.
- Once the attacker sets the IP address to IP subnet, it starts scanning the whole network to find out the IP address as well as the MAC address of all the hosts on the subnetwork.
- In the next step, a victim is targeted, and the attacker starts sending ARP packet across the Local Area Network (LAN), but the attacker replaces the MAC address of the target with its own MAC address while the IP address remains the same that of a victim.
- As discussed in the previous blog about ARP– the communication at the data link layer happens using the MAC address.
- So, the packets meant for the victim now gets rerouted to the attacker because the MAC address has been spoofed and replaced with the attacker’s MAC address.
- Once the attacker begins getting the packets meant for the victim, it can further launch different attacks.
List ARP spoofing attack
Here is the list of the types ARP Spoofing attacks that an attacker can hit the victim with –
-
DDoS attack –
Denial of Service attack usually involves directing/redirecting too much traffic to a victim to handle. Using ARP spoofing, the attacker associates multiple IP addresses to a single MAC address on a network.
Because of that, the volume of traffic meant for different machines gets redirected to a particular host. The volume of traffic overwhelms the target machine so much so that it gets overloaded and cannot perform other tasks. Read more about DOS attacks.
-
Man in the middle
In the Man in the Middle attack, the attacker sits in between the communication that happens between two users. It uses independent connections between two targets giving an illusion to the targets as if they are talking among themselves. Here is a perfect example of this attack given on Wikipedia.
Detection and prevention of ARP Spoofing attack
-
Authentication and data encoding
Authenticating a data sender’s identity in some way can prevent receiving data from a malicious user. Authentication uses credentials from both the systems to authenticate the users.
On top of that, the data is encrypted using some keys by the sender before sending it to the receiver. The encrypted data can only be decoded by some keys which have already been shared by the sender to the receiver beforehand. These things are a part of network security and especially encryption and decryption.
-
Packet lifters
Packet filters are like inspectors which sit and carefully examine all the packets being transmitted across the network. Packet filters are often a part of the firewall programs which keep on looking out for the malicious packets.
For example, a malicious packet could contain packets from outside the network that shows source addresses from inside the network and vice-versa.
-
Using static ARP
This is an old school way, but it works well. You manually set up a static ARP for your computers on the subnetwork so that there are no chances of any alterations. However, it is not recommended for a large network because there will a lot of static ARPs, and any small changes will be too much work for the network administrator.
-
Using VPN’s
Using VPNs (Virtual Private Networks) is one of the best ways to get protection against ARP spoofing attack (here are some best VPNs). A Virtual Private Network uses an encrypted tunnel for not only data transmission but also the data that goes through it is encrypted.
-
Use anti ARP tools
Most of the methods mentioned above either require investment or are not completely failsafe such as Static ARP technique. It can only prevent simple ARP attacks. Some of the ways that Network’s admins recommend are using anti-ARP tools to identify and stop the attacker.
ARP attack software’s
- ARP0c/WCI: According to the provider, ARP0c/WCI is a tool that uses ARP spoofing to intercept connections in a private network. To do this, the software sends false ARP response packets, which redirect traffic to the system running ARP0c/WCI. The integrated bridging engine is used to forward information to the actual target system. Packets that aren’t delivered locally are forwarded by ARP0c/WCI to the appropriate router. A man-in-the-middle attack generally remains undetected. The program is available for both Linux and Windows and can be downloaded free of charge on the provider’s website.
- AR poison: The command line tool AR poison generates user-defined ARP packets, in which the user can set the sender and target addresses. AR poison can be used for network analysis, but is also used as an attack software. The tool is available for free and operated under the GNU license.
- Cain&Abel: The Cain&Abel program, developed as an old password recovery tool, makes it possible to intercept networks and decrypt their encrypted passwords. Since version 2.5, the software also contains ARP poisoning functions that intercept IP traffic in the switched LANs. Even SSH and HTTPS connections are no hurdle for Cain&Abel. In order to analyse WLAN network traffic, the program has supported the AirPcap adapter since version 4.0, which enables the passive reading of data traffic in the WLAN. Attacks against WPA-secured wireless networks have been possible since version 4.9.1.
- Dsniff: Dsniff is a collection of programs that provide a variety of tools for network analysis and penetration tests: with Dsniff, Filesnarf, Mailsnarf, Msgsnarf, Urlsnarf, and Webspy it’s possible to spy on networks and intercept data, emails, or passwords. Arpspoof, Dnsspoof, and Macof make it possible to detect data that’s normally not accessible in switched networks. Man-in-the-middle attacks on SSH and SSL/TLS secured connections can be implemented through SShmitm and Webmitm programs.
- Ettercap: The user-friendly APR spoofing tool Ettercap is primarily used for man-in-the-middle attacks. The software supports diverse Linux distributions as well as Max OS X (Snow Leopard and Lion). A Windows installation is possible, but requires additional settings. In addition to the user interface, thencurses front-end and the GTK2 GUI graphical user interfaces are available. Actions such as Sniffing, ARP attacking, and collection of passwords can be automated. Ettercap can manipulate intercepted data and attack connections that are secured via SSH or SSL. The program is officially offered as security software and is used in product testing.
- FaceNiff: The Android app FaceNiff allows users to read session cookies in WLAN networks and to take offer sessions. Hackers utilize the tool in order to hack into Facebook, Amazon, or Twitter accounts, so it doesn’t matter whether the wireless network is freely available or encrypted via WEP, WPA-PSK, or WPA2-PSK. A reliable protection against FaceNiff can be found in authentication protocol EAP (Extensible Authentication Protocol) such as SSL. The Android software is based on the Firefox extension Fire sheep and can be used on smartphones in combination with the previously installed standard browser.
- NetCut: With the network management software NetCut, administrators can manage their network on the basis of ARP. The tool detects all devices connected to the network and outputs their MAC addresses. A simple click on one of the listed addresses is enough to disconnect the device from the network. Net Cut is particularly suitable for DoS attacks, provided the attacker is on the same network as the victim; man-in-the-middle attacks cannot be implemented with this software.
Here is all the information you want regarding the ARP spoofing attack. The measure to take for detection and prevention of ARP spoofing are fully proved and trustable.
