ARP Vulnerabilities
Indefensible Local Network Attacks?
Mike Beekey
Mike Beekey- Black Hat Briefings 01 1
Overview
ARP Refresher ARP Vulnerabilities Types of Attacks Vulnerable Systems Countermeasures Detection Tools and Utilities Demonstrations
2
Mike Beekey- Black Hat Briefings 01
ARP Refresher
Mike Beekey- Black Hat Briefings 01
ARP Message Formats
ARP packets provide mapping between hardware layer and protocol layer addresses 28 byte header for IPv4 ethernet network
8 bytes of ARP data 20 bytes of ethernet/IP address data
6 ARP messages
ARP request and reply ARP reverse request and reply ARP inverse request and reply
Mike Beekey- Black Hat Briefings 01 4
ARP Request Message
Source contains initiating systems MAC address and IP address Destination contains broadcast MAC address ff.ff.ff.ff.ff.ff
Mike Beekey- Black Hat Briefings 01
ARP Reply Message
Source contains replying systems MAC address and IP address Destination contains requestors MAC address and IP address
Mike Beekey- Black Hat Briefings 01
ARP Vulnerabilities
Mike Beekey- Black Hat Briefings 01
Unsolicited ARP Reply
Any system can spoof a reply to an ARP request Receiving system will cache the reply
Overwrites existing entry Adds entry if one does not exist
Usually called ARP poisoning
Mike Beekey- Black Hat Briefings 01
Types of Attacks
Mike Beekey- Black Hat Briefings 01
Types of Attack
Sniffing Attacks Session Hijacking/MiM Denial of Service
Mike Beekey- Black Hat Briefings 01
10
Sniffing on a Hub
Sniffer
Source
Destination
CISCOSYSTEMS
Hub
Mike Beekey- Black Hat Briefings 01 11
Switch Sniffing
Normal switched networks
Switches relay traffic between two stations based on MAC addresses Stations only see broadcast or multicast traffic
Compromised switched networks
Attacker spoofs destination and source addresses Forces all traffic between two stations through its system
Mike Beekey- Black Hat Briefings 01
12
Host to Host Exploit
Client (C)
Server (S)
Hostile
Real ARP Reply
Spoofed ARP ReplyC Spoofed ARP ReplyS
Broadcast ARP Request
Mike Beekey- Black Hat Briefings 01
13
Host to Router Exploit
Client (C)
Gateway Router (R)
CISCO SYSTEMS
Hostile
Real ARP Reply
Spoofed ARP ReplyC Spoofed ARP ReplyR
Broadcast ARP Request
Mike Beekey- Black Hat Briefings 01
14
Relay Configuration
Attacker 0:c:3b:1a:7c:ef- 10.1.1.10
Alice 0:c:3b:1c:2f:1b- 10.1.1.2 0:c:3b:1a:7c:ef- 10.1.1.7
Mike Beekey- Black Hat Briefings 01
Bob 0:c:3b:9:4d:8- 10.1.1.7 0:c:3b:1a:7c:ef- 10.1.1.2
15
Relay Configuration (cont.)
Sniffer Source Destination
CISCOSYSTEMS
Switch
Mike Beekey- Black Hat Briefings 01 16
Sniffing Comments
Depending on traffic content, attacker does NOT have to successively corrupt cache of both endpoints Useful when true permanent ARP entries are used or OS is not vulnerable to corruption
Mike Beekey- Black Hat Briefings 01
17
Session Hijacking/MiM
Natural extension of sniffing capability Easier than standard hijacking
Dont have to deal with duplicate/un-syncd packets arriving at destination and source Avoids packet storms
Mike Beekey- Black Hat Briefings 01
18
Denial of Service
Spoofing the destination MAC address of a connection will prevent the intended source from receiving/accepting it Benefits
No protocol limitation Eliminates synchronization issues
Examples
UDP DoS TCP connection killing instead of using RSTs
Mike Beekey- Black Hat Briefings 01
19
DoS MAC Entries
Attacker 0:c:3b:1a:7c:ef- 10.1.1.10
Alice 0:c:3b:1c:2f:1b- 10.1.1.2 a:b:c:1:2:3- 10.1.1.7
Mike Beekey- Black Hat Briefings 01
Bob 0:c:3b:9:4d:8- 10.1.1.7 0:c:3b:1c:2f:1b 10.1.1.2
20
Denial of Service Examples
Mike Beekey- Black Hat Briefings 01
21
Web Surfing
Web surfers require gateway router to reach Internet Method
Identify surfers MAC address Change their cached gateway MAC address (or DNS MAC address if local) to something else
Mike Beekey- Black Hat Briefings 01
22
Network-based IDS
Poorly constructed (single homed) IDS network systems relay auditing data/alerts to management/admin consoles Method
Identify local IDS network engine Modify gateway MAC address Modify console/management station address
Mike Beekey- Black Hat Briefings 01 23
Hostile Users
Attacker continuously probing/scanning either your system or other target Method
Scanning you Scanning a system under your protection
Mike Beekey- Black Hat Briefings 01
24
Switch Attacks
Certain attacks may overflow switchs ARP tables Method
A MAC address is composed of six bytes which is equivalent to 2^48 possible addresses See how many randomly generated ARPreplies or ARP requests it takes before the switch fails
Mike Beekey- Black Hat Briefings 01 25
Switch Attacks (cont.)
Switches may
Fail open- switch actually becomes a hub Fail- no traffic passes through the switch, requiring a hard or soft reboot
Mike Beekey- Black Hat Briefings 01
26
Network Bombs
Hidden application installed on a compromised system Method
Passively or actively collects ARP entries Attacker specifies timeout or future time Application transmits false ARP entries to its list
Mike Beekey- Black Hat Briefings 01
27
Vulnerable Systems
Mike Beekey- Black Hat Briefings 01
28
Operating Systems
Windows 95 Windows 98 Windows NT Windows 2000 AIX 4.3 HP 10.2 Linux RedHat 7.0 FreeBSD 4.2 Cisco IOS 11.1 Netgear
Mike Beekey- Black Hat Briefings 01
29
Not Vulnerable
Sun Solaris 2.8
Appears to resist cache poisoning
Mike Beekey- Black Hat Briefings 01
30
Countermeasures
Mike Beekey- Black Hat Briefings 01
31
Firewalls
Most personal firewalls are not capable of defending against or correctly identifying attacks below IP level UNIX
ipfw ipf (IP Filter)
Windows environments
Network Ice/Black Ice
Mike Beekey- Black Hat Briefings 01
32
Session Encryption
Examples
Establishing VPNs between networks or systems Using application-level encryption
Effects
Prevents against disclosure attacks Will not prevent against DoS attacks
Mike Beekey- Black Hat Briefings 01
33
Strong Authentication
Examples
One-time passwords Certificates
Effects
None on disclosure attacks None on DoS attacks
Mike Beekey- Black Hat Briefings 01
34
Port Security
Cisco switches
set port security ?/? enable <MAC address>
Restricts source MAC addresses
Hard coded ones Learned ones
Ability to set timeouts Ability to generate traps Ability to shutdown violating port
Mike Beekey- Black Hat Briefings 01
35
Port Security (Cont.)
Issues
Only restricts source MAC addresses Will not prevent against ARP relay attacks Will only prevent against ARP source spoofing attacks
Mike Beekey- Black Hat Briefings 01
36
Hard Coding Addresses
Example
Individual systems can hard code the corresponding MAC address of another system/address
Issues
Management nightmare Not scalable Not supported by some OS vendors
Mike Beekey- Black Hat Briefings 01 37
Hard Coding Results
Operating System
Windows 95 Windows 98 Windows NT Windows 2000 Linux RedHat 7.0 FreeBSD 4.2 Solaris 2.8
Results
FAIL FAIL FAIL FAIL YES YES YES
Mike Beekey- Black Hat Briefings 01
38
Countermeasure Summary
Sniffing
Session Hijacking
Denial of Service
Firewalls Session Encryption Strong Authentication Port Security Hard Coding
Mike Beekey- Black Hat Briefings 01
39
Detection
Mike Beekey- Black Hat Briefings 01
40
IDS Architecture Issues
Management Console
Network Monitor
Management Console
Network Monitor
Monitored Network
Monitored Network
Critical Server
Hostile System
Critical Server
Hostile System
Mike Beekey- Black Hat Briefings 01
41
OS Level Detection
Operating System
Windows 95 Windows 98
Windows NT Windows 2000 Linux RedHat 7.0 FreeBSD 4.2
Detection
NO NO
NO NO NO YES
Mike Beekey- Black Hat Briefings 01
42
Hypothetical Detection Application
Purpose
Track and maintain ARP/IP pairings Identify non-standard ARP-replies versus acceptable ones
Timeout issues
OS must withstand corruption itself Fix broken ARP entries of systems
Transmission of correct ARP replies
Mike Beekey- Black Hat Briefings 01
43
Tools and Utilities
Mike Beekey- Black Hat Briefings 01
44
Public Domain Tools
Manipulation
Dsniff 2.3 Hunt 1.5 Growing number of others
Local monitoring
Arpwatch 1.11
Mike Beekey- Black Hat Briefings 01
45
Bibliography
Finlayson, Mann, Mogul, Theimer, RFC 903 A Reverse Address Resolution Protocol, June 1984 Kra, Hunt 1.5, http://www.gncz.cz/kra/index.html, Copyright 2000 Lawrence Berkeley National Laboratory, Network Research Group, Arpwatch 1.11, ftp://ftp.ee.lbl.gov/arpwatch.tar.Z, Copyright 1996 Plummer, David C., RFC 826 An Ethernet Address Resolution Protocol, November 1982 Russel, Ryan and Cunningham, Stace, Hack Proofing Your Network,, Syngress Publishing Inc, Copyright 2000 Song, Dug, Dsniff 2.3, http://www.monkey.org/~dugsong/, Copyright 2000
Mike Beekey- Black Hat Briefings 01
46
Demonstrations
Mike Beekey- Black Hat Briefings 01
47
Demo Environment
172.16.10.40 FreeBSD/ Win2k
CISCOSYSTEMS
802.11b
172.16.10.30 Linux Redhat
172.16.10.25 FreeBSD 4.2
Mike Beekey- Black Hat Briefings 01
172.16.10.133 Win2k
48
Demonstration Tools
rfarp 1.1
Provides ARP relay capability and packet dump for two selected stations Corrects MAC entries upon exiting
farp 1.1b
Passive and active collection of ARP messages DoS Attacks on single hosts DoS Attacks on entire collection Arbitrary and manual input of spoofed MAC addresses
Mike Beekey- Black Hat Briefings 01
49
ARP Attacks
Disclosure attacks
ARP relaying for a single target Sniffing attacks
DoS related
Port scan defense DoS attacks on a single host, group, or subnet
Mike Beekey- Black Hat Briefings 01
50
Questions
Mike Beekey- Black Hat Briefings 01
51
