1. What is ARP Spoofing? Answer: An attacker node sends ARP Reply to a victim with a fake identity and corrupts the victim’s ARP cache. Next time, when the victim wants to send data to other nodes, packets are received by the attacker mode. It can then copy or modify data and forward packet to the target nodes. 2. How does ARP Spoofing work? Answer: It takes several steps. The key is attacker sending an ARP Reply with fake identity. 1) In a 3-node LAN, node A wants to send packets to node B, but does not know B’s MAC. A sends a broadcast ARP Request to find B’s MAC. 2) The attacker node C receives ARP Request and saves A’s (IP, MAC) in its ARP cache. 3) When B wants to send a packet to A, it first sends a broadcasting ARP Request to find A’s MAC. 4) Attacker receives this ARP Request and stores B’s (IP, MAC) in its ARP cache. 5) Now the attacker knows both A and B’s addresses. It sends an ARP Reply to B with fake identities: Source IP is IP_A, Source MAC is MAC_C. C is telling B: I am A, my MAC is MAC_C. 6) B trusts ARP Reply it received and changes its ARP cache entry (IP_A, MAC_A) to (IP_A, MAC_C). 7) When B wants to send packets to A, it encapsulates the packet by i) using IP_A for the network destination address; ii) using MAC_C for its link destination MAC. As a result, the packet is received by C, not A. 8) When the attacker receives packets, it can store data then send to A, or modify data before forwarding them to A. This change is transparent to A and B. They are unaware of the attacker 3. Why ARP Spoofing? There is an advantage to learn or modify other people’s data. For example, military spies, financial transactions. ARP is a simple protocol. It's not hard to fake identities with ARP. There are software tools available. 4. How to prevent ARP spoofing? No much. Periodically flush ARP cache can remove fake MAC addresses. But spoofing tool can easily send more ARP Reply to inject false MAC into ARP caches.
Arp spoofing (arp picture book 7 from visual land animations)
ARP spoofing ARP tutorial with pictures -7 www.visualland.net <ul><li>Watch animation to learn networking. </li></ul><ul><li>Visualize how ARP translates IP address into MAC. Watch interactions between ARP Request, ARP Reply, and ARP cache. </li></ul><ul><li>This pictured tutorial takes screenshots from ARP spoofing Animation . </li></ul><ul><li>OK to republish this slide. Please use hyperlink to point to its source . </li></ul>05/16/11 www.visualland.net
ARP animations <ul><li>ARP basic - update For behinners. Observing basic ip-mac binding interactions (ARP Request, ARP reply, ARP cache, ping encapsulation, ping command.) </li></ul><ul><li>ARP basic - no update Same as above. But the node receiving ARP Request does not update its ARP cache. (It's a vendor decision whether to update ARP cache when receiving RAP request). </li></ul><ul><li>ARP hub Three hosts are connected to a hub. Run ping to observe how ARP frames and ping packets are being flooded by hub. </li></ul><ul><li>ARP switch Three hosts are connected to a switch. Run ping to observe ARP frames are being flooded and switched by the switch. </li></ul><ul><li>ARP router gateway (Lab) Visualize how ARP discovers a MAC in a different subnet when hosts are connected to a router and the router is the default gateway. </li></ul><ul><li>ARP router proxy (Lab) Visualize how ARP discovers a MAC in a different subnet when hosts are connected to the same router but have no default gateway. </li></ul><ul><li>ARP spoofing (Theory) Visualize how a hacker can listen and corrupt IP-MAC bindings in other's ARP caches, and kidnap data. </li></ul><ul><li>ARP spoofing (Lab) Same as above. The animation data is captured from a simulation Lab (dynamips). Timing is realistic. </li></ul>05/16/11 www.visualland.net
Brief ： ARP spoofing Animation Link 05/16/11 www.visualland.net Goal. Visualize how hackers exploit ARP's weakness to fool hosts and steal data with fake ARP reply. Topology: 3 hosts H1, H2, H3, are connected by a switch S1. H3 is the hacker. Steps: 1) When H1 sends ARP request to find H2's MAC, S1 floods the ARP frame. H3 learns H1's MAC. 2) H2 receives ping and can't echo H1. It sends ARP request to find H1's MAC. S1 floods it. Hacker is able to learn H2's MAC. 3) H3 pretends as H1 and sends a fake ARP reply to H2. H2 update ARP cache with the new "H1" MAC. 4) H1 ping H2. H2 sends echo. Switch forwards echo to H3, not H1.
H1 sends ARP request <ul><li>H1 wants to ping H2 but does not know its MAC. H1 sends ARP request. </li></ul><ul><li>When switch S1 receives ARP request, it floods the frame to H2, H3 (Attacker). </li></ul><ul><li>Also, S1 adds the new MAC entry (MAC.H1, F0/1) to its MAC table. </li></ul>05/16/11 www.visualland.net
H2, Hacker learn H1’s MAC 05/16/11 www.visualland.net - H2 receives ARP request, checks its sender/target's ip/mac, adds H1's MAC to ARP cache, and sends an ARP reply back tyo H1. - H3 (Attacker) receives ARP request, reads protocol's sender ip/mac, and adds H1's MAC to its ARP cache. H3 is a hacker. It ignores the target. It interests in finding sender's address. This is a side effect of broadcasting and flooding: everyone can receive it.
H1 ping H2 05/16/11 www.visualland.net When receiving ARP Reply, H1 updates ARP cache, changes (IP.H2, Incomplete) to (IP.H2, MAC.H2) Then H1 ping H2 again. S1 forwards ping to H2, no flooding this time.
H2 can’t echo: ARP Request 05/16/11 www.visualland.net H2 receives ping but can't send echo back. Echo fails due to an ARP miss. H2's ARP cache does not contain H1's MAC. So H2 sends an ARP request.
Hacker learns H2 MAC 05/16/11 www.visualland.net - S1 receives ARP request and floods it to H1, H3. - When H1 receives ARP request, it sends ARP reply back to H2 to tell its MAC. - When H3 receives H2's ARP request, it steals H2's MAC and stores it in ARP cache. Now H3 has both H1 and H2's MACs. It is ready to act now.
Hacker sends ARP Reply to H2 05/16/11 www.visualland.net While H1 is sending ARP reply to H1, hacker (H3) starts to attack. H3 sends an ARP reply to H2 with fake IDs: ARP's sender ip = H1's IP, sender mac = H3's MAC. His goal is to fool H2. It wants H2 to think that H1 has changed its MAC address and the new MAC is H3's MAC. Click ARP Reply to see fake ID in protcol header..
H2 is fooled by Attacker 05/16/11 www.visualland.net H2 receives two ARP Replies. - The first one is from H1. H2 adds a new entry (IP.H1, MAC.H1) to its ARP cache. - The second ARP reply is from H3. H2 changes H1's ARP cache entry from (IP.H1, MAC.H1) to (IP,H1, MAC.Attacker). Now H2 thinks H1's MAC is MAC.Attacker. it is being fooled. But H2 does not know.
H1 ping H2 05/16/11 www.visualland.net Now H1 ping H2 again. It is switched by S1 to H2.
H2 echo H1. But received by H3 05/16/11 www.visualland.net When H2 receives ping, it responds an echo. H2 encapsulates echo's Link header destination addresses with (IP.H1, MAC.Attacker). When S1 receives echo, it uses echo's destination MAC (MAC.Attacker) to lookup MAC table and forwards echo to F0/3. As a result, H3 (the Attacker) has receives the echo, not H1. Note: This tutorial show how ARP spoofing works. Hackers can do many harmful things. E.g., alter data and retransmit packets to target, store data and use it for illegal actions.
FAQ <ul><li>What is ARP Spoofing? </li></ul><ul><li>How does ARP Spoofing work? </li></ul><ul><li>Why ARP Spoofing? </li></ul><ul><li>How to prevent ARP spoofing? </li></ul><ul><li>（ answers in the Comments box ） </li></ul>05/16/11 www.visualland.net
What is Vlab visualland.net <ul><li>VLAB: Virtual Lab </li></ul><ul><ul><li>Theory: Visualize key points of network protocols to help beginners grasp the basic ideas quickly. </li></ul></ul><ul><ul><li>Lab: Visualize network activities with packets and router states captured from network simulators (dynamips, packet tracer, and ns2. </li></ul></ul><ul><ul><li>Interactively control animation: packet headers, protocol state tables. </li></ul></ul><ul><li>Vlab usage </li></ul><ul><ul><li>Self learning, teaching aids, lab book. </li></ul></ul>05/16/11 www.visualland.net