1. An Introduction To ARP Spoofing & Other Attacks
Presenting : Philip Yakubovsky & Ohad Benita

2. A computer connected to
INTRODUCTION
A computer connected to
an IP/Ethernet LAN
has two addresses
MAC/Ethernet Address
Address of the
network card
In theory, unique &
unchangeable
IP Address
Virtual address
Assigned via
software

3. A computer connected to A computer connected to
INTRODUCTION
A computer connected to
an IP/Ethernet LAN
has two addresses
A computer connected to
an IP/Ethernet LAN
has two addresses
IP Address
Used by applications
Independent of whatever
network technology operates
underneath it
Each computer on a network
must have an unique IP address
to communicate
MAC/Ethernet Address
Necessary for Ethernet to send data
Independent of application protocols
Divides data into 1500 byte frames
Each frame has a header containing
the MAC address of the source and
destination computer.

4. INTRODUCTION
IP & Ethernet must work together!

5. Does anyone have IP 10.0.0.3? If so, tell me your MAC address!
OPERATION
ARP Request
Does anyone have IP ? If so, tell me your MAC address!
(IP)
(MAC)
(IP)
(MAC)
)IP(
(MAC)
(IP)
(MAC)
ARP
network
Company Logo

6. OPERATION ARP Request network ARP 10.0.0.1 (IP)
(MAC)
(IP)
(MAC)
I do!!! My MAC address is
)IP(
(MAC)
(IP)
(MAC)
ARP
network
Company Logo

7. OPERATION Kept locally to minimize number of ARP
requests being broadcast
Updates the cache with the new IP/MAC
associations for each reply
Stateless protocol
- Most operating systems will update
the cache if a reply is received,
regardless of whether they sent out
an actual request
ARP Cache
Add Your Title
Add Your Title

8. OPERATION Involves constructing forged ARP replies
ARP Spoofing
Involves constructing forged ARP replies
Takes advantage of the ARP cache
Process of corrupting cache is
“Poisoning”
Ad Your Title

9. OPERATION
ARP Spoofing
ARP Request
ARP Cache

10. OPERATION
ARP Spoofing
ARP Response
ARP Cache

11. OPERATION
ARP Spoofing
ARP Response
ARP Cache

12. OPERATION
ARP Spoofing
ARP Response
ARP Cache

13. Attacks – Sniffing Promiscuous mode
- Allows network cards to examine frames that are destined for MAC addresses other than their own
Switches
- Allows network cards to examine frames that are destined for MAC addresses other than their own

14. Attacks - Sniffing Man-in-the-Middle Attack (MiM) A malicious user:
Inserts his computer between the communications path of two target computers
Forwards frames between the two target computers so communications are not interrupted
All Internet traffic could be intercepted if this was performed between the target and router

15. Attacks – Sniffing MAC Flooding Storms
Send spoofed ARP replies to a switch at an extremely rapid rate
Switch’s port/MAC table will overflow
Results vary
Some switches will revert into broadcast mode, allowing sniffing to then be performed
Storms
Poisoning caches with the broadcast address could cripple large networks
Attacks – Sniffing

16. Attacks - DoS Denial of Service
Update ARP caches with non-existent MAC addresses
Causes frames to be dropped
Could be sent out in a sweeping fashion to DoS all clients in the network
Possible side effect of post-MiM Attacks

17. DoS - SYN Attack
The SYN attack is a common denial of service (DoS) technique characterized by the following pattern:
Using a spoofed IP address an attacker sends multiple SYN packets to the target machine.
For each SYN packet received, the target machine allocates resources and sends an acknowledgement (SYN-ACK) to the source IP address.

18. DoS – SYN Attack
The target machine doesn't receive a response from the attacking machine, it attempts to resend the SYN-ACK five times, at 3,6,12, 24,48 sec. intervals, before un-allocating the resources 96 seconds after attempting the last retry.
If you add it all together, you can see that the target machine allocates resources for more than 3 minutes to respond to just one SYN attack.

19. Attacks - Hijacking Connection Hijacking
Allows an attacker to take control of a connection between two computers
Can result in any type of session being transferred

20. Attacks - Cloning MAC Address cloning
MAC addresses intended to be globally-unique and unchangable
Today, MAC addresses can be easily changed
An attacker could DoS a target computer, clone the target’s MAC address, and recieve all frames intended for the target

21. DEFENSES D E No universal defense F N S
Static (non-changing) ARP entries
Port security (or Port Binding, MAC Binding)
Detection: •ARPWatch • Reverse ARP (RARP)

22. Defenses – Static Route
Static Routes
ARP caches have static (non-changing) entries
Spoofed ARP replies are ignored
Creates lots of overhead
Each ARP cache must have static entry for every computer on the network
Non practical for most LANs
Result can also vary depending on the operating system

23. Defenses – MAC Binding MAC Binding
Feature found on high-quality switches
Does not allow the MAC address associated with a port to change once it has been set
Legitimate changes can be performed by the network administrator
Does not prevent ARP spoofing, but does prevent MAC cloning & spoofing

24. Detection Detection ARPWatch (Free UNIX Program) Reverse ARP (RARP)
Listens for ARP replies on the network and builds a table of IP/MAC associations
When IP/MAC associations change (flip-flop), an is sent to the administrator
Reverse ARP (RARP)
Requests the IP of a known MAC address
Can be used to detect MAC cloning
Promiscuous Mode Sniffing
Many methods exist for detecting machines in promiscuous mode

25. The exact behavior of ARP varies with
DETECTION
The exact behavior of ARP varies with
Different
operating
systems
Different
operating
system versions
Different
network
hardware

26. CONCLUSION
ARP Spoofing is one of several vulnerabilities which exist in modern networking protocols.
- IP Spoofing
- TCP sequence prediction
- ICMP-based attacks
It is unlikely that this problems will be addressed until abused on a wide enough scale to force a change in the status quo.

27. Company Logo

28. Thank You !