Hello and welcome back!
In the last lectures we've discussed what ARP poisoning is and how to execute an ARP poison attack using
both Ettercap and Bettercap. Let's recap in just a few words
what was all about.
A Man in the Middle Attack of type ARP poisoning is achieved when an attacker poisons the ARP cache of
two devices with its own MAC address; once the ARP cache has been successfully poisoned
each of the victim devices sends all of their packets to the attacker when communicating to each other.
This puts the attacker in the middle of the communication between the two victim devices,
hence the name Man in the Middle Attack.
It allows an attacker to easily monitor all communication between victim devices.
The purpose is to take over the session, intercept and view of the information being passed between the
two victim devices; let's go ahead and see the techniques to mitigate this attack.
We divide these techniques in 2 categories.
There is a central solution for the entire LAN which is implemented on the switch and is called Dynamic
ARP Inspection or DAI.
It has a dependency on the DHCP Snooping which must be enabled.
DHCP Snooping feature is covered in more details
in another lecture. Dynamic ARP Inspection is a security feature that is available on professional networking
devices like Cisco switches.
It helps prevent ARP poisoning and other ARP based attacks by intercepting all ARP requests and responses
and by verifying their authenticity before forwarding the packets to the intended destinations.
The switch creates a trusted binding table of IP and MAC addresses and then discards any ARP packets
that are inconsistent with the information contained in the binding table.
This binding table is dynamically populated by the DHCP Snooping or statically by admin for a static
IP addresses.
If you activate dynamic ARP inspection and DHCP Snooping on each switch and the possible attacker
starts and are poisoning attack the switch will not forward to the hosts
the ARP reply packets that associate the IP of the victim to the MAC of the attacker; it will verify each
intercepted packet for a valid IP to MAC binding. I will not show you how to configure it because it's
not the purpose of this lecture but I'll attach a full documentation of how to do it
as a source for this lecture. Besides Dynamic ARP Inspection, which is a solution for enterprise
networks and involves expensive switches,
there are also local solutions that can be applied to each individual host.
Let's take a look at these solutions! First I'll start an apr spoofing attack usin gEttercap.
ettercap -T- M ARP and the victims: the default gateway and the windows machine
okay.
The attack is running!
Now on the victim
I'm displaying the ARP table: arp-a
and we notice how the MAC of the attacker is associated with both the default gateway and the attacker.
By inspecting of the ARP table
this way you can become aware that you are a victim of an ARP spoofing attack.
But let's be honest who would continuously check the ARP table?
It's not only impossible to do it on our regular basis but also annoying! The good news is that there
are tools that automatically monitor for you
the ARP table and generate an alert when something bad happens. You can see here a lot of tools that
do this. One well-known tool is X ARP which works both on Linux and Windows.
There is also a very good tool called ARP Watch for Linux based systems and I have used it successfully
many times. Let's download and install X ARP on the victim machine.
Download! I am downloading the Windows version and I will install it
and I'm running it
OK.
We notice that X ARP has generated an alert saying an ARP spoofing attack
it's running.
This is the alert ! OK.
It noticed that the MAC address for this IP address the default gateway changed; this is what
X ARP does. It alerts you when something bad is happening! I'm stopping the attack; let's move on and
take a look at another solution to mitigate the ARP spoofing attack.
You can use static ARP entries to combat spoofing and the Man in the Middle Attacks; statis
ARP entries are IP MAC bindings that are manually added to the cache table for a device and are
retained in the case on a permanent basis; when this is done the OS will ignore all ARP responses
for the specific IP address used in the entry and use the specified MAC address instead.
You need to create ARP table entries for all of the devices on your LAN and this is not scalable. If
you have n- devices you must create in total n(n-1)/2 entries or if you
have 10 devices you have to create 45 ARP entries.
You can automated the process by using scripting or we can at least protect the default gateway or the
main server. At the end of this lecture
I'll show you how to detect different protocol anomalies including an ARP storm which is in fact a kind
of network scanning. Let's open wireshark!
And I'll go to a Edit Preferences Protocols and I'm searching for ARP and I'm selecting Detect ARP Request
storms OK and I'll start the capture.
I'm returning to Kali and I'll run net discover; net discover is a reconnaissance tool used to detect
online hosts or search for them by sending ARP requests.
It's scanning the network with ARP request packets OK.
These are the hosts; let's return to Wireshark! We see a lot of ARP packets. Let's stop capturing packets!
I'll go to Analyse Expert Information and we see here useful information including information about
the ARP attack, ARP storm packet detected and the number of ARP packets for the past 100 milliseconds.