IP address spoofing is an age-old problem that has been the subject of much discussion, yet it remains a relevant issue today. Being able to impersonate someone else on a network grants a great deal of power and, consequently, a great deal of potential for harm.
IP spoofing, therefore, involves spoofing at Layer 3 of the OSI model.
Here are the risks you face if you do not prevent IP address spoofing:
– INTERNAL INTERCEPTION: Redirect traffic to a compromised machine that records everything
The hacker replaces the legitimate network gateway address with that of a compromised machine configured to forward all traffic to the real gateway, while logging all traffic (passwords, SNMP communities, etc.) in the process.
– DENIAL OF SERVICE: Prevent traffic from reaching its destination
The hacker replaces the legitimate network gateway address with that of a machine that "drops" all packets (except, possibly, those intended for it). At that point, no further communication is possible on the network.
– DENIAL-OF-SERVICE: Redirecting traffic to a machine in order to overload it
The hacker replaces the legitimate address of the network gateway with that of a server, which will then receive all traffic intended for the gateway and may become overwhelmed by the volume of traffic.
– EXTERNAL INTERCEPTION: Redirect DNS requests to a compromised server that forwards them to phishing sites
The hacker replaces the legitimate DNS address with that of a compromised server. When a client requests the IP address of www.unsite.fr, the compromised DNS server provides the address of a phishing site that mimics www.unsite.fr and records the victim’s login credentials (username, password, credit card number, etc.).
Among other things, there are two well-known methods for carrying out this type of spoofing that, unfortunately, are not often taken into account: DHCP spoofing and ARP spoofing.
These are old enough that countermeasures already exist. Nevertheless, during our audits, we all too rarely find that these safeguards are in place.
They can be deployed on switches or routers/firewalls, but are rarely enabled in the default configuration of major manufacturers. It is therefore the network administrator’s responsibility to ensure that they are implemented.
It is necessary to state the obvious regarding these two well-known protocols in order to explain the vulnerabilities that are being exploited. In this article, we will focus on ARP.
Address Resolution Protocol (ARP)
Protocol
The ARP protocol provides a link between Layer 2 (MAC address) and Layer 3 (IP address) of the OSI model. The expected behavior is as follows:
- A client machine wants to reach a specific IP address, but it does not have that address's MAC address in its ARP cache. It therefore sends a broadcast request (which means the entire network segment can receive it) specifying the IP address it is looking for and its own MAC address (so that a response can be sent to it).
- The machine with the IP address being searched for performs two actions:
- To ensure she responds to the correct machine, she updates her own ARP cache with the MAC address and IP address of the machine that made the request.
- It sends an ARP response containing its IP address and MAC address to the machine that made the request.
- The first machine receives the response and updates its ARP cache with the new entry it received. It now knows the MAC address of the IP address it was trying to reach.
The ARP protocol can be used in several different ways; this is just one of them. Another very interesting use involves “ARP announcements” (or gratuitous ARP) packets.
They are used when a machine A has just changed its IP address. Rather than waiting for other machines to send an ARP request or mistakenly send packets to the old IP address, A sends an “announcement” specifying its new MAC address/IP address pairing. All other machines then update their ARP tables.
Attacks
One of the main problems with the ARP protocol is that it is stateless (stateless). A machine will therefore always update its ARP cache when it receives an ARP response, even if it did not initiate the request.
The update always overwrites the previous entry associated with an IP address, if it exists, and there is no authentication mechanism available for ARP.
The principle behind an attack is therefore simple: if you have a MAC address A and want to impersonate another machine that has a MAC address B and an IP address C, all you have to do is send everyone an ARP response containing the A/C pairing.
The machines will then overwrite the old B/C association in their ARP table and replace it with the new one. Traffic addressed to IP address C will therefore be routed to the machine with MAC address A.
In addition to spoofing, it is also possible to target third-party machines. All the malicious activities associated with IP spoofing are therefore possible, plus:
– DENIAL OF SERVICE: Intercepting traffic intended for a third-party machine
The attacker floods the network with ARP responses that associate his MAC address with the victim's IP address. As a result, none of the traffic intended for the victim will reach her, and she will be unable to initiate connections with other services (she can send requests but will not receive responses).
This type of attack is only possible within the broadcast address range; since ARP packets are not routed, it is therefore not possible to infect other segments of the network.
Countermeasures
Dynamic ARP Inspection (DAI)
ARP dynamic monitoring uses DHCP snooping (see the article) to verify the validity of the ARP responses sent.
Since the switch maintains a database of [IP Address / MAC Address / Port] mappings, it is able to inspect all ARP packets that pass through it or are addressed to it.
All it needs to do is read the IP/MAC pair provided in the ARP packet and verify that it matches the one assigned by the DHCP server (via the DHCP snooping database). If necessary, the packet is discarded (it may also be logged and an administrator contacted), unless it comes from a trusted port—for example, to allow the DHCP server to propagate its new IP address if it has changed.
If the IP address in question has never been assigned, it will not be in the DHCP snooping database; therefore, this is not a mismatch but rather a lack of a match. It is still best to drop the packet.
Depending on the vendor, there may be some nuances in how the DAI behaves, particularly regarding additional checks on the source port of the ARP packet or the appropriate action to take if an address is missing from the DHCP snooping database.
DHCP filtering
This countermeasure is offered by several manufacturers and is also based on DHCP snooping.
This involves checking, at the switch level, the source port of each packet. By consulting the DHCP snooping IP/MAC/port association database, the packet’s source IP address is compared to the legitimate IP address assigned by the DHCP server. If there is a discrepancy, the packet is discarded.
This is therefore a measure taken after the fact to address IP address spoofing (the attacker has already managed to forge an illegitimate frame), but it helps prevent its malicious use.
Conclusion
IP address spoofing generally exploits inherent weaknesses in both the DHCP and ARP protocols, which were not originally designed to address security issues.
Security has therefore been shifted to the network nodes (switches, routers/firewalls), which monitor and analyze requests and responses to detect attempts to exploit DHCP or ARP.
However, these mechanisms are too rarely enabled by default, so the network administrator must be proactive enough to consider the threats to their network and enable the appropriate mechanisms accordingly.
However, this type of attack is widely used in internal security audits. It generally allows attackers to retrieve all passwords transmitted in plain text (FTP, SNMP, email, etc.) and, in some cases, those that are encrypted if the user ignores the certificate warning (which invariably happens at least once).
Vendors such as Cisco, HP, Dell, Juniper, H3C, and Allied Telesis include these countermeasures.
Written by D.S. – ITrust Security Expert
