Now in this lecture and the next few lectures I want to start talking about mine in the middle attacks.
These are attacks that we can launch only if we are able to intercept the communication between two
devices.
Hence the name mine in the middle attacks.
So a normal communication would look like this where the device is directly communicating with the entity
that they want to communicate with in a mine in the middle attack.
The hacker would be able to place themselves in the middle of the connection allowing them to enter
served and see anything that is being transferred between these two devices.
Now there are a number of ways to achieve this.
The first method that we'll cover in this chorus is using an IP spoofing attack.
AARP spoofing allow us to redirect the flow of packets.
So instead of it Floyd as shown in this diagram it would flow through my own computer.
So any requests sent and any responses received by the targeted computer will have to flow through the
hacker computer.
This means that any messages any website and images and user names any passwords and to it by the target
will have to flow through my computer.
This allows me to read this information modify it or drop it.
So as you can see this is a very serious and very powerful attack.
And the reason why it is possible is because a PE is not very secure.
Now for us to understand how this works you need to have a basic understanding of what a rpe is.
Our PEER stands for address resolution protocol and it's a very simple protocol that allows us to link
IP addresses to my addresses.
So for example let's say we have a network here.
We have devices A B C and the they're all connected to the same network.
And we have the right here for this network.
We can see that each device has an IP and a MAC address.
And let's assume that device a needs to communicate with the voice see.
Now we're also going to assume that device a no is the IP of a device see what as we know so far.
In order for these devices to communicate within the same network device a needs to know the MAC address
of device see.
Because like we said before the communication inside the network is carried out using the MAC address
and not using the IP address.
So this is a perfectly normal situation where we have a client that needs to know the MAC address of
another client so that it can communicate with the client.
So what the supply and does it uses the arpu product what do I mean by that.
Basically it sends a broadcast message so it sends an IP request to all the clients on the network saying
who has 10 0 2 6.
Now all of these devices will ignore this packet except the one that has this IP address which is days
to six which is device C. So all devices will not do anything.
And the only device that will respond is device C sending in a pure response in this response device
is going to say I half days you ought to say X my MAC address is this Mike address.
This way device a will have the MAC address of the Boise and now it'll be able to communicate with the
boycie and do whatever task that it wanted to do initially.
So all of this communication is facilitated using the AARP protocol.
Like I said the IP protocol is a very simple protocol as you kiss you on the towers is requests and
the responses are.
The whole point of it is so that we can link IP addresses to MAC addresses or translate IP addresses
to Mike addresses.
So a device can send their request asking for a MAC address and then the device that has the MAC address
would respond with its Mike address.
So each computer have an IP table which links IP addresses on the same network to their MAC addresses.
So if I go on the candy machine and do AARP a you can see my AARP table here.
And as you can see it's like in the rotaries IP to the outer is Mike address.
No sane.
If I go to the Windows machine and the reason why it's anybody.
And do a r p a.
You'll see again it's Lincoln the routier is IP to its Mike address.
So this machine any time it needs to send any request to the internet it will direct that request to
this MAC address to the MAC address that's associated with the IP of the routier which is 10 0 to 1.
Now this value in year can be easily modified by exploiting the AARP protocol.
So let me go back to my diagrams.
And right here we have a diagram of a typical network and you can see that normally any device that's
connected to the network if it wants to send the requests it will send them to the routier.
The writer will go and send that request to the Internet wait for the response and then forward the
response to the device that requested it.
So if the hiker or the victim or any other computer on the network wanted to send a request they will
send that request.
The right lead to the rafter.
Now what we can do is we can exploit the arpu Protocol and send to our p responses one to the gateway
and one to the victim will again tell the gateway that I am at the IP of the victim so the access point
will update.
It's a peace table and it'll associate the IP of the target with my MAC address.
We'll do the same with the victim so we'll send it an AARP response.
We're again told that ah yeah there's zero to one.
So it's going to of date it's a arpey table and associate the IP of 10 0 to one with my own MAC address.
So the result of this the victim is going to think that I am the writer and the writer is going to think
that I am the victim.
So any time the victim wants to send any requests the requests will have to flow through my computer
and I'm going to forward them to your outer and then any time the access point or their outer wants
to send a response is they're going to go to my machine because it thinks that I am the victim and then
I'm going to forward it to the victim.
So as you see this puts me in the middle of the connection and it gives me so much power.
And we'll see all the things that we can do once we become the mine in the middle.
No the main reason why we can do all of this is because a our P is not secure because first of all clients
can accept responses even if they did not send their request.
So as I said before we're going to send the response to the access point and the response to the victim
tell them that I am at a specific IP without them asking who are my own without them asking for this
IP I'm just going to send a response and they're going to accept that response.
Any white.
Not only that were there also not going to verify who I am.
So when I say that I am a 10 0 2 7 I am clearly not at that IP because this computer is out this IP
but the access point will trost this and it'll actually update.
It's a rpe table based on the information that I send.
Same goes to the victim.
I'm going to tell it that I am at in 0 2 1.
It's going to trust and believe this even though I am clearly not at this IP because the access point
is at this IP.
So these are the two main weaknesses with a arpey Protocol that allow us to run a rpe call a tax.