1. ARP Spoofing Attacks Dr. Neminath Hubballi IIT Indore © Neminath Hubballi

2. What is ARP?  Address Resolution Protocol maps IP address to MAC address Purpose of ARP 32-bit Internet address 48-bit Ethernet address ARP  ARP CACHE : IP – MAC Bindings IPMACTYPE 10.0.0.200:00:00:00:00:02dynamic

3. How ARP Works?  ARP Request is Broadcast to all the hosts in LAN 10.0.0.1 10.0.0.3 10.0.0.2 00:00:00:00:00:01 00:00:00:00:00:03 00:00:00:00:00:02 Who has IP 10.0.0.2? Tell your MAC address ARP Request IIT Indore © Neminath Hubballi

4. How ARP Works? 10.0.0.1 10.0.0.3 10.0.0.2 00:00:00:00:00:01 00:00:00:00:00:03 00:00:00:00:00:02 ARP Reply I have IP 10.0.0.2 My MAC is 00:00:00:00:00:02  Unicast Reply from concerned host IIT Indore © Neminath Hubballi

5. ARP Cache Stores IP-MAC Pairs 10.0.0.1 10.0.0.3 10.0.0.2 00:00:00:00:00:01 00:00:00:00:00:03 00:00:00:00:00:02  ARP cache : updated IPMACTYPE 10.0.0.200:00:00:00:00:02dynamic ARP Reply IIT Indore © Neminath Hubballi

6. Why is ARP Vulnerable?  ARP is a stateless protocol  Hosts cache all ARP replies sent to them even if they had not sent an explicit ARP request for it.  No mechanism to authenticate their peer IIT Indore © Neminath Hubballi

7. Known Attacks Against ARP  ARP Spoofing  Man-in-the-Middle Attack  Denial-of-Service Attack  MAC Flooding ( on Switch )‏  DoS by spurious ARP packets IIT Indore © Neminath Hubballi

8. ARP Spoofing Attack  Attacker sends forged ARP packets to the victim 10.0.0.1 10.0.0.2 00:00:00:00:00:01 00:00:00:00:00:02 I have IP 10.0.0.3 My MAC is 00:00:00:00:00:02 ARP Reply IPMACTYPE 10.0.0.300:00:00:00:00:02dynamic Attacker Target Victim 10.0.0.3 00:00:00:00:00:03 IIT Indore © Neminath Hubballi

9. Spoofing Results in Redirection of Traffic 10.0.0.1 00:00:00:00:00:01 10.0.0.2 00:00:00:00:00:02 Packets for 10.0.0.3 10.0.0.3 00:00:00:00:00:03 IIT Indore © Neminath Hubballi

10. Man-in-the-Middle Attack Allows Third Party to Read Private Data 10.0.0.1 10.0.0.3 10.0.0.2 00:00:00:00:00:03 00:00:00:00:00:02 ARP Reply Attacker IPMACTYPE 10.0.0.300:00:00:00:00:01dynamic IPMACTYPE 10.0.0.200:00:00:00:00:01dynamic 00:00:00:00:00:01 10 IIT Indore © Neminath Hubballi

11. Man-in-the-Middle Attack 10.0.0.1 10.0.0.3 10.0.0.2 00:00:00:00:00:03 00:00:00:00:00:02 00:00:00:00:00:01 Attacker IPMACTYPE 10.0.0.300:00:00:00:00:01dynamic IPMACTYPE 10.0.0.200:00:00:00:00:01dynamic To 10.0.0.3 To 10.0.0.2 IIT Indore © Neminath Hubballi

12. Denial of Service Stops Legitimate Communication  A malicious entry with a non-existent MAC address can lead to a DOS attack 10.0.0.1 10.0.0.2 00:00:00:00:00:02 I have IP 10.0.0.3 My MAC is XX:XX:XX:XX:XX:XX ARP Reply IPMACTYPE 10.0.0.3XX:XX:XX:XX:XX:XXdynamic Attacker Victim 00:00:00:00:00:01 Target 10.0.0.3 00:00:00:00:00:03 12 IIT Indore © Neminath Hubballi

13. Denial of Service Stops Legitimate Communication 00:00:00:00:00:01  Victim unable to reach the IP for which the forged packet was sent by the attacker 10.0.0.1 10.0.0.2 00:00:00:00:00:02 IPMACTYPE 10.0.0.3XX:XX:XX:XX:XX:XXdynamic Attacker Victim PING 10.0.0.3Request timed out. IIT Indore © Neminath Hubballi

14. MAC Flooding Degrades Network Performance  Attacker bombards the switch with numerous forged ARP packets at an extremely rapid rate such that its CAM table overflows PORTMAC 100:00:01:01:01:01 200:00:02:02:02:02 ….…… …..……. 10.0.0.1 00:00:00:00:00:01 Attacker 14 IIT Indore © Neminath Hubballi

15. DoS by Spurious ARP Packets  Attacker sends numerous spurious ARP packets at the victim such that it gets engaged in processing these packets  Makes the Victim busy and might lead to Denial of Service 10.0.0.1 00:00:00:00:00:01 Attacker Victim Spurious ARP Packets Busy Processing IIT Indore © Neminath Hubballi

16. Detection and Mitigation Techniques  Static ARP Cache entries—Fixed IP-MAC pairs  ARPWATCH /COLOSOFT CAPSA/ARP-Guard- Maintains a database with IP- MAC mappings and any change detected is reported to administrator  Count the imbalance in number of requests and responses  Evaded  Cryptographic Techniques:  Secure ARP – use cryptographic algorithms to authenticate  TARP- ticket based IIT Indore © Neminath Hubballi