In the last lecture we've seen what's ARP and how it works.
Now it's time to go deep into Man in the Middle Attack and ARP poisoning. Let's
go ahead to the ARP poisoning
aka ARP spoofing attack.
This is a MITM attack that is carried out over a Local Area Network (LAN) and involves sending
malicious ARP reply packets to at least 2 hosts on the network
which are the victims of the attack. A MITM attack is a cyber attack in which a hacker
inserts himself in a conversation between 2 users or applications, either to eavesdrop or to impersonate
one of the parties, making it to appear as if a normal exchange of information is underway.
The goal of an attack is to steal personal information such as log in credentials, account details or
credit card numbers.
Critical to this scenario is that the victim isn't aware of the Man in the Middle. Most of the time
router, which is the default gateway of the LAN, is one of the victims.
This allows the hacker to intercept packets on a network, modified the traffic or stop all traffic.
Often this attack is used as an opening for other attacks.
Let's take a closer look at this image.
I want to explain to you how the attack works. The hacker or the malicious user will continuously send
ARP reply packets to both the default gateway and the user in the LAN which is the victim of the
attack. In these special crafted ARP reply packets the
hacker will associate its own MAC address with the IP address of the other host, such as a web
server or the default gateway
It will cause any traffic meant for that IP address, the default gateway
in this case, to be sent to the attacker instead.
Note that clients accept responses even though they didn't send the request.
They simply trust the ARP response without any form of verification.
This is a weakness in ARP protocol that allows the existence of the ARP spoofing attack. In this image
the hacker will send an ARP reply packet to the host saying that the IP address of the default gateway
has its own MAC address,
the hackers MAC address. It will also send another ARP reply packet to the default gateway saying
that the IP address of the host has the MAC address of the hacker; the user will save in its ARP table
the IP address of the default gateway and the MAC address of the hacker and the default gateway will
save in its ARP table the IP address of the user and the MAC address of the same hacker.
Now when the host wants to send the packet outside the local network, so to the Internet, it will use
the IP address or the domain of the destination, for example Google.com and MAC Address of the
router found by ARP.
This is how networks work.
Each packet destined to a destination outside the LAN will be sent to the MAC address of the DG.
The switch that receives the packet will forward the packet based on the destination MAC
address and will forward it to the hacker because that’s the destination MAC address of the packet.
Now if the hacker just wants to read the data and remain invisible he will read the packet contents
and then forwarded to the real destination.
When the return traffic from the Internet
hits the router’s interface, the router will forward the packet to the destination host in the
LAN.
It will search for the MAC address of the destination in its
ARP table and use that MAC address in the packet header. Now, as we’ve already learned, in ARP
table the IP address of the host is mapped to the MAC address of the hacker so the hacker will receive
the response packet. It will capture and inspect the packet and then forwarded to the actual destination.
If the hacker just wants to launch a denial of service attack he simply drops the packets.
This type of attack remains invisible to the victim.
Now you have a very good understanding of how ARP and ARP poisoning work. In the next lecture
we'll launch the attack!