ARP spoofing

From Wikipedia, the free encyclopedia
  (Redirected from ARP poisoning)
Jump to: navigation, search
A successful ARP spoofing (poisoning) attack allows an attacker to alter routing on a network, effectively allowing for a man-in-the-middle attack.

ARP spoofing[note 1] is a technique whereby an attacker sends fake ("spoofed") Address Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.

ARP spoofing may allow an attacker to intercept data frames on a LAN, modify the traffic, or stop the traffic altogether. Often the attack is used as an opening for other attacks, such as denial of service, man in the middle, or session hijacking attacks.[1]

The attack can only be used on networks that make use of the Address Resolution Protocol (ARP), and is limited to local network segments.[2]

Vulnerabilities of the Address Resolution Protocol[edit]

The Address Resolution Protocol (ARP) is a widely used protocol for resolving network layer addresses into link layer addresses.[note 2]

When an Internet Protocol (IP) datagram is sent from one host to another on a local area network, the destination IP address must be converted into a MAC address for transmission via the data link layer.[2] When another host's IP address is known, and its MAC address is needed, a broadcast packet is sent out on the local network. This packet is known as an ARP request. The destination machine with the IP in the ARP request then responds with an ARP reply, which contains the MAC address for that IP.[2]

ARP is a stateless protocol. Network hosts will automatically cache any ARP replies they receive, regardless of whether or not they requested them. Even ARP entries which have not yet expired will be overwritten when a new ARP reply packet is received. There is no method in the ARP protocol by which a host can authenticate the peer from which the packet originated. This behavior is the vulnerability which allows ARP spoofing to occur.[1][2]

Anatomy of an ARP spoofing attack[edit]

The basic principle behind ARP spoofing is to exploit the above-mentioned vulnerabilities in the ARP protocol by sending spoofed ARP messages onto the LAN. ARP spoofing attacks can be run from a compromised host on the LAN, or from an attacker's machine that is connected directly to the target LAN.

Generally, the goal of the attack is to associate the attacker's MAC address with the IP address of a target host, so that any traffic meant for the target host will be sent to the attacker's MAC instead. The attacker could then choose to:

  1. Inspect the packets, and forward the traffic to the actual default gateway (interception)
  2. Modify the data before forwarding it (man-in-the-middle attack).
  3. Launch a denial-of-service attack by causing some or all of the packets on the network to be dropped

Defenses[edit]

Static ARP entries[edit]

IP-to-MAC mappings in the local ARP cache can be statically defined, and then hosts can be directed to ignore all ARP reply packets.[3] While static entries provide perfect security against Spoofing if the operating system handles them correctly, they result in quadratic maintenance efforts as IP-MAC mappings of all machines in the network have to be distributed to all other machines.

ARP spoofing detection software[edit]

Software that detects ARP spoofing generally relies on some form of certification or cross-checking of ARP responses. Uncertified ARP responses are then blocked. These techniques may be integrated with the DHCP server so that both dynamic and static IP addresses are certified. This capability may be implemented in individual hosts or may be integrated into Ethernet switches or other network equipment. The existence of multiple IP addresses associated with a single MAC address may indicate an ARP spoof attack, although there are legitimate uses of such a configuration. In a more passive approach a device listens for ARP replies on a network, and sends a notification via email when an ARP entry changes.[citation needed]

OS security[edit]

Operating systems react differently, e.g. Linux ignores unsolicited replies, but on the other hand uses seen requests from other machines to update its cache. Solaris accepts updates on entries only after a timeout. In Microsoft Windows, the behavior of the ARP cache can be configured through several registry entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, ArpCacheLife, ArpCacheMinReferenceLife, ArpUseEtherSNAP, ArpTRSingleRoute, ArpAlwaysSourceRoute, ArpRetryCount.[4]

AntiARP[5] also provides Windows-based spoofing prevention at the kernel level. ArpStar is a Linux module for kernel 2.6 and Linksys routers that drops invalid packets that violate mapping, and contains an option to repoison/heal.

The simplest form of certification is the use of static, read-only entries for critical services in the ARP cache of a host. This prevents only simple attacks and does not scale on a large network, since the mapping has to be set for each pair of machines resulting in approximately n2 ARP entries that have to be configured when n machines are present: On every machine there must be an ARP entry for every other machine on the network, which are n ARP entries on every of the n machines.

Legitimate usage[edit]

The techniques that are used in ARP spoofing can also be used to implement redundancy of network services. For example, some software allows a backup server to issue a gratuitous ARP request in order to take over for a defective server and transparently offer redundancy.[6] [7]

ARP spoofing is often used by developers to debug IP traffic between two hosts when a switch is in use.

Tools[edit]

Defense[edit]

  • DefendARP:[8] A host-based ARP table monitoring and defense tool designed for use when connecting to public wifi. DefendARP detects ARP poisoning attacks, corrects the poisoned entry, and identifies the MAC and IP address of the attacker.
  • anti-arpspoof[9]
  • Arpwatch
  • ArpON: Portable handler daemon for securing ARP against spoofing, cache poisoning or poison routing attacks in static, dynamic and hybrid networks.
  • Antidote:[10] Linux daemon, monitors mappings, unusually large number of ARP packets.
  • Arp_Antidote:[11] Linux Kernel Patch for 2.4.18 - 2.4.20, watches mappings, can define action to take when.
  • Arpalert: Predefined list of allowed MAC addresses, alert if MAC that is not in list.
  • Arpwatch/ArpwatchNG/Winarpwatch: Keep mappings of IP-MAC pairs, report changes via Syslog, Email.
  • Prelude IDS: ArpSpoof plugin, basic checks on addresses.
  • Snort: Snort preprocessor Arpspoof, performs basic checks on addresses
  • XArp:[12] Advanced ARP spoofing detection, active probing and passive checks. Two user interfaces: normal view with predefined security levels, pro view with per-interface configuration of detection modules and active validation. Windows and Linux, GUI-based.

Spoofing[edit]

Some of the tools that can be used to carry out ARP spoofing attacks:

Name OS GUI Free Protection Per interface Active/passive
Agnitum Outpost Firewall Windows Yes No Yes No passive
AntiARP Windows Yes No Yes No active+passive
Antidote Linux No Yes No ? passive
Arp_Antidote Linux No Yes No ? passive
Arpalert Linux No Yes No Yes passive
ArpON Linux/Mac/BSD No Yes Yes Yes active+passive
ArpGuard Mac Yes No Yes Yes active+passive
ArpStar Linux No Yes Yes ? passive
Arpwatch Linux No Yes No Yes passive
ArpwatchNG Linux No Yes No No passive
Colasoft Capsa Windows Yes No No Yes no detection, only analysis with manual inspection
dSploit Android (rooted only) Yes Yes No ? passive
Prelude IDS ? ? ? ? ? ?
remarp Linux No Yes No No passive
Snort Windows/Linux No Yes No Yes passive
Winarpwatch Windows No Yes No No passive
XArp[12] Windows, Linux Yes Yes (+pro version) Yes (Linux, pro) Yes active + passive
Seconfig XP Windows 2000/XP/2003 only Yes Yes Yes No only activates protection built-in some versions of Windows
zANTI Android (rooted only) Yes Yes No ? passive

Notes[edit]

  1. ^ Also known as ARP cache poisoning or ARP poison routing(APR)
  2. ^ ARP was defined by RFC 826 in 1982.

References[edit]

  1. ^ a b Ramachandran, Vivek & Nandi, Sukumar (2005). "Detecting ARP Spoofing: An Active Technique". In Jajodia, Suchil & Mazumdar, Chandan. Information systems security: first international conference, ICISS 2005, Kolkata, India, December 19-21, 2005 : proceedings. Birkhauser. p. 239. ISBN 978-3-540-30706-8. 
  2. ^ a b c d Lockhart, Andrew (2007). Network security hacks. O'Reilly. p. 184. ISBN 978-0-596-52763-1. 
  3. ^ Lockhart, Andrew (2007). Network security hacks. O'Reilly. p. 186. ISBN 978-0-596-52763-1. 
  4. ^ Address Resolution Protocol
  5. ^ AntiARP
  6. ^ "OpenBSD manpage for CARP (4)". , retrieved 2013-01-04
  7. ^ Simon Horman. "Ultra Monkey: IP Address Takeover". , retrieved 2013-01-04
  8. ^ Defense Scripts | ARP Poisoning
  9. ^ anti-arpspoof[dead link]
  10. ^ Antidote
  11. ^ Arp_Antidote
  12. ^ a b XArp
  13. ^ "Subterfuge Project". Retrieved 2013-11-18. 
  14. ^ "Seringe - Statically Compiled ARP Poisoning Tool". Retrieved 2011-05-03. 
  15. ^ a b c d e f g h i j "ARP Vulnerabilities: The Complete Documentation". l0T3K. Retrieved 2011-05-03. 
  16. ^ "ARP cache poisoning tool for Windows". Retrieved 2012-07-13. [dead link]
  17. ^ "Simsang". Retrieved 2013-08-25. 

See also[edit]

External links[edit]