To perform N.P. poisoning the attacker must change certain entries in the air cash speaking more precisely.
You will replace the IP the default gateway the DNS server or the database server of your computer with
the ones of his own machine thus bypassing the higher layer protocols.
Your computer will be sending data not to the router or a database server but to the attackers computer.
Only the attacker knows what he's going to do with the data then he can send it to its original destination
so that the victim won't notice the attack.
This technique is called The Man in the middle attack.
It's the first threat will demonstrate in a moment
before we do that.
However it's advisable that we briefly discuss how the ATO to one standard helped secure the link layer
the standard defines methods of medium access control.
Usually it's associated with wireless networks but it does apply to wired networks as well.
In both cases its aim is to block access to the medium.
For example a port with a switch will remain closed.
The red light above the switch will glow until the host computer identity is verified.
The standard is implemented through a radius server.
The server verifies the identity of the device.
For example a computer rather than the identity of the user when the verification is over.
The green light above the port will go on your computer is called the supplicant.
It will try to connect the authenticator.
In this case to a managed switch before the green light lights up the authenticator will ask you to
send some certificates.
More specifically the EAP protocol which we'll discuss later on
next.
The killer will forward these certificates to the radius server.
The server will verify whether the computers send the required certificate and this so it will unblock
the switch port.
Only then the computer will get access to the network.
It seems to be a very secure method especially if you use certificates to verify the identity of the
computer certificates are difficult to fake.
It's not even done because it's simply ineffective.
There is however another serious problem.
Many companies invested huge amounts of money on implementing the readiest server and 8 to 1 X standard
in their local wired networks.
The standard is also very effective in wireless networks.
The problem is that in the data link layer of the oocyte model a host is identified by its MAC address
and we already know that the MAC address can easily be changed
to connect to a company network secured in the way we've just described the attacker must first wait
for one of the computers to authenticate which will be signaled by a green light above the port that's
just open.
Then the attacker must disconnect the user from the port and connect his own hub instead the hub will
broadcast all packets passing through a to all switch ports.
It does becomes a kind of signal multiplexer
next detector must connect the user's computer to the hub so it will still be part of the network.
The user unaware of all of this is able to use the network normally.
If the attacker connects his computer to the hub he'll be able to intercept the client's communication
with the whole network.
The attacker can do much more than simply intercept network traffic.
You can also obtain the client's computer MAC address in the second layer of us-I model MAC addresses
are not encrypted.
Now the attacker can change his computer's MAC address to the one he obtained.
If the attackers computer MAC address is the same as the victims.
But the machines have different IP addresses.
The attacker will gain access to the UDP protocol and the TCAP protocol as well
the victim's firewall is almost always active.
Without elaborating on a subject that's yet to be introduced.
Let's just mention that the TCAP protocol is a delivery protocol.
This means it allows for a bi directional connection.
If the attacker and the victim are identified by the same MAC address the packets sent by.
For instance a database server will be delivered to both machines the attacker will try to connect to
the server sending a sin packet.
The server will respond by sending the signal packet to both computers.
The victim didn't expect to receive the packet so in accordance with our A C standard it will send back
a reset packet and close the current session.
However this scenario won't happen because the signal packet will be blocked by the firewall.
The firewall will reject the packet and no reset packet will be sent back.
Now the attacker is connected to the open port after the port based user authentication took place.
This allows him to intercept all traffic directed to the client and connect to the servers behind the
switch the attacker achieved that by spoofing them victims.
MAC address
this in turn means that it only takes a hub worth about $15 to defeat a complex security infrastructure
of the radius server certification server and such.
As we know from one of the previous lecturers it's a perfect example of an ineffective security policy.