Hello guys and welcome!
We'll start a series of lectures on DHCP security. At the end
you will know how to hack the DHCP and what are the countermeasures you can take.
Let's take a look at the purpose of DHCP and how it works.
This is really necessary in order to deeply understand the attacks on the DHCP and how to mitigate the
impact. Dynamic Host Configuration Protocol or DHCP is used to dynamically provide IP addresses and other
configuration information to host on the wired or wireless networks.
When you connect your mobile phone or your laptop to the WiFi network they will receive all necessary
information to communicate on the network and on the Internet like IP address, network mask, default gateway,
and DNS servers from the DHCP server which in many cases, especially in small LANs is the router.
The configuration is assigned with a lease time. For the end user DHCP works behind the scenes.
Let's see in a nutshell how it really works! The admin sets up the DHCP server and creates pools of addresses
available for assignment to the client's, wired or wireless. When a device is turned on and connected
to the network
if it’s configured to use DHCP for its network configuration , it will send a request to the server,
called DHCPDISCOVER. This first message is a broadcast one and that means that any host on the network
will receive it.
Maybe there are more the DHCP servers and each server will respond back to the offer. After DISCOVER
packet reaches the DHCP server the server reserves an IP address for the client and makes a
lease offer by sending a DHCPOFFER message to the client.
This package contains an IP address, a subnet mask, a lease duration and the IP address of the server
making the offer. This second message is a Unicast packet so only the requesting client will receive
it. In response to DHCP offer, the client replies with a DHCPREQUEST message, broadcast to the server,
requesting the offered
address. Why is this a broadcast packet?
It's because a client can receive the DHCP offers from multiple servers but it will accept only one, the
DHCP offer. Based on the required server identification option in the request and broadcast messages servers
are informed whose offer the client has accepted.
And finally the server will send the DHCP acknowledgement packet to confirm the configuration to the
client. This packet includes the lease duration and any other configuration information that the client
might have requested.
At this point the IP address configuration process is completed.
If the server decides that the device cannot have the IP address it will send a negative acknowledgment
or an NACK packet. When the client leaves the network
it could be sent the DHCP Release to inform the server that will deactivate its address.
The server can offer this IP address to another client.
Let's see if these DHCP messages in Wireshark. I'm opening Wireshark and I am starting the capture on
the WiFi interface.
It's capturing data.
Now I am connecting my mobile phone to the WiFi network.
My mobile phone like the vast majority of the phones is configured to automatically set up its network
parameters using DHCP and I am connecting it to the network.
You won't see this, I have the phone in my hand!
You are seeing a lot of traffic but I am filtering to see only the DHCP packets.
So I am applying a display filter DHCP; perfect!
If it doesn't recognize that the DHCP filter option, especially in older versions of Wireshark, you cant
write boot p as well. so bootp
Bootp
or boot protocol is in fact an older version of the DHCP like a legacy DHCP. Both options are working
but I'm writing back DHCP and we notice the broadcasted discovery message sent by the phone.
This was received by any host on the network including this Windows machine then the server responded
back with an offer sent to unicast. We can't see the packet on another host, like on this Windows
machine, because it's a unicast packet. And in the third step the phone has requested the offer
sending a broadcast message that we can see in Wiresharc. Now that you know in detail how DHCP works
let's go ahead and take a look at the attacks on DHCP.
Note that the attacks could happen due to lack of any authentication mechanism between DHCP server and
the DHCP clients. There are mainly the following types of attacks:
The DHCP flooding, the DHCP starvation and DCP rogue server.
Let's take them one by one! In a DFCP flooding attack
the hacker will flood the server with fake DHCP discover messages.
The server will start processing these messages and become unavailable for legitimate clients that will
not receive an IP configuration.
This is a denial of service attack.
The DHCP starvation attack occurs when an attacker constantly sends fake
DHCP requests with spoofed MAC addresses to the DHCP server.
Eventually, there are no more IP addresses available to allocate to legitimated devices and the network
becomes unusable.
This is also a denial of service attack.
DHCP peak, DHCP starve, Gobbler or Yersina are tools that can perform these attacks. We'll
see them live in the next lectures. And the last attack
we are talking about is called DHCP rogue server. A rogue DHCP server is a server set up on the network
by an attacker or by an unaware user and is not under the control of the network admin. Using rogue
server
the attacker can start sending IP addresses and other configuration settings to the network DHCP clients.
These configuration settings include default gateway and the DNS server IP addresses that are not the
legitimate once but are of the attacker or under its control. Once the default gateway IP address of
the network devices is changed
the network hosts start sending the traffic destined to outside networks to the attacker's computer.
The hacker can now capture sensitive user data and launch a man-in-the-middle attack.
This is also called a DHCP spoofing attack.
Hackers can also set up a rogue DNS server and deviate the user traffic to fake websites and launch
phishing attacks. Okay!
In this lecture we have seen how the DHCP works,
what are the security problems and how a hacker could attack the DHCP. In the next lectures
I'll show you live examples of these attacks.