1. 1/22 ARP Problems and Solutions Yasir Jan Future Internet 15 th May 2008

2. 2/22 Contents ARP Caching GARP Spoofing Attack Types Dangers Defense Methods ARP Flooding Summary References

3. 3/22 ARP ARP is like searching for somebody’s location in the crowd ARP finds out MAC address of a device in a network, when it’s IP address is known Fig: ARP is like searching for a person in crowd

4. 4/22 ARP Basics Sender broadcasts ARP request in the network Receiver sends a unicast reply with its MAC address, to the sender Devices maintain a cache to store addresses in a table Fig: ARP cacheFig: ARP communication

5. 5/22 ARP Caching Mapping between IP address and MAC address are cached in a memory table, for future transmission. A new entry is added to the ARP cache when an IP address is successfully mapped to a MAC address. Usually, entries are added dynamically to the ARP cache. Static entries can also be added. New address are overwritten on old addresses. An entry in an ARP cache is removed after a pre-determined timeout period of about 20 minutes A host will update its ARP cache, only if the ARP request is for its IP address. Otherwise, it will discard the ARP request If host updates cache with any ARP requests, it will exhaust the ARP cache with a lot of unused ARP entries.

6. 6/22 Gratuitous ARP An ARP request packet where destination MAC is the broadcast address Ordinarily, no reply packet will occur for Gratuitous Request Gratuitous ARP reply is a reply to which no request has been made. Gratuitous ARP request or gratuitous ARP reply is not normally needed according to the ARP specification (RFC 826) but could be used in some cases.

7. 7/22 ARP Steps and problem Request Broadcasted: Everybody, even attacker, will know who is requesting info from whom Reply accepted without authentication: Reply from an attacker, lie, will also be accepted as true Reply having no request (like Gratuitous Reply) may be processed for optimizing performance: Attacker can easily modify the cache of victim using Gratuitous ARP (GARP) Problem: ARP Spoofing, ARP Poisoning, Cache Poisoning, ARP Poison Routing (APR) – Victim gets false information in cache

8. 8/22 ARP spoofing Attacker acts as a middle-man during communication of both devices Attacker may send ARP/GARP requests and replies to change the cache tables and do cache poisoning There are different types of ARP packets sent by attacker depending upon it’s intention Fig: Cache poisoning is dangerous

9. 9/22 Attack types If ARP or GARP packet contains… Then… 1MAC that does not exist on network and IP address that does not exist on network The attacker may be trying to fill up the IP ARP table so that the subnet’s router cannot learn more addresses. As a result, return (routed) traffic may not be forwarded 2MAC that is owned by attacker and IP address that does not exist on network the attacker is using IP address that administrator has not assigned and so may be trying to avoid traceability

10. 10/22 Attack types (contd…) If ARP or GARP packet contains… Then… 3MAC that is owned by attacker and IP address that is owned by another host the attacker is trying to intercept traffic destined for this host 4MAC that does not exist on network and IP address that exist on network the attacker is trying to cause traffic to this IP address to flood to all hosts in the subnet. However, hosts disregard the traffic. This means that attacker receives the traffic and intended recipient ignores it.

11. 11/22 ARP Spoofing Dangers An attacker may listen to everything on the network, and find out all secret information flowing through the network unsecured ARP spoofing tools used for finding passwords while unsecured transmission to community sites like MySpace [ http://www.ethicalhacker.net/content/view/182/1/] Attacker will be able to do Passive sniffing - Just check and forward to intended host Data modification - Put links to malicious objects in transmitted data Denial of Service attack - Associate non existent MAC address to IP address of victim’s default gateway

12. 12/22 Defense methods 1) Static (non changing) ARP entries So ARP cache update is not employed at all Not practical on large networks 2) Virtual LANs Create boundaries which ARP traffic cannot cross, limiting number of clients to attack But has it’s own vulnerabilities, and limitations 3) ARP spoof detection software tools Programs like “Arpwatch” listens for ARP replies on network, and sends notification via email when an ARP entry changes User will decide, so may not always make a proper decision.

13. 13/22 Defense methods (contd…) 4) “Anticap” Do not update ARP cache when an ARP reply carries a different MAC address for an IP already in cache Will issue a kernel alert in such case 5) “Antidote” When an ARP reply tries to bring some change, it first checks whether old MAC is alive or not If previous MAC is alive, the update is rejected and new MAC address is added to “banned” addresses An attacker may spoof the sender MAC address and force a host to ban another host

14. 14/22 Defense methods (contd…) 6) SLL Encryption SLL defines authentication messages that hosts send to each other to perform mutual authentication and session key exchange Too slow and complex for ARP 7) S-ARP Each host has a public/private key certified by local trusted party on LAN ARP reply is signed by sender, and update is done only if signature is verified Attacker may get signature by a request

15. 15/22 Defense methods (contd…) 8) Time passwords Along with the signature there is a time password which changes in every request Attacker may not be able to get whole signature in single attack 9) RARP for detecting MAC address cloning A query for finding IP address of an associated MAC address is generated If more than one IP address is returned, MAC cloning is present

16. 16/22 Defense methods (contd…) 10) DHCP snooping Implemented on equipments of Cisco, Extreme Networks and Allied Telesis Rejecting GARP packets: Configure switches and routers to ignore GARP packets Let switch snoop DHCP packets and decide who is authorized to access the IP network Statistically bind IP address and MAC combinations to switch ports Reject ARP messages unless they come from an IP address in DHCP snooping database

17. 17/22 Defense methods (contd…) Local Proxy ARP Access router responds to ARP requests with it’s own MAC address, instead of destination device’s MAC address. This forces clients to send all data to access router. It checks a list of filters for forwarding or dropping decision MAC-Forced Forwarding Like Local proxy ARP, MACFF replies with MAC address of access router instead of real address. Edge switch works out which MAC address to reply with from information provided by DHCP snooping. There is a record of IP, MAC and port assignment. So MACFF knows which router’s MAC address to provide when it sees an ARP from the client.

18. 18/22 ARP Flooding Several viruses send a lot of ARP traffic in an attempt to discover hosts to infect A lot of ARP traffic from a single machine, looking for MAC addresses for many of the IP addresses on your local network, there might be a virus on your network that's scanning your network for machines to infect. It's been claimed that the Wootbot virus does this Install antivirus on your system

19. 19/22 IPv6 and ARP IPv6 uses Neighbor Discovery method for determining link-layer addresses, to find routers and to maintain reachability information about the paths to active neighbors [RFC 2461] It is a combination of ARP, ICMP Router discovery and ICMP redirect Redirects contain link-layer address of first hop; separate address resolution is not needed upon receiving a redirect Unlike ARP, Neighbor Discovery detects half-link failures (using Neighbor Unreachability Detection) and avoids sending traffic to neighbors with which two-way connectivity is absent It was obsoleted by RFC 4861 (Sep 2007), which has some extra features added in Neighbour Discovery

20. 20/22 Summary ARP has no self authentication mechanism Attacker can do spoofing and perform dangerous activities Extra techniques, software or hardware are needed for increasing security Authentication methods are most reliable for secure transmission of ARP packets

21. 21/22 References http://www.wikipedia.org/ http://www.springerlink.com/content/e2by156nj83365lc/fulltext.pdf http://wiki.wireshark.org/Gratuitous_ARP http://www.alliedtelesis.com/media/datasheets/howto/secure_network_ l3switches.pdf http://www.alliedtelesis.com/media/datasheets/howto/secure_network_ l3switches.pdf http://www.grc.com/nat/arp.htm Images taken from various sources on web

22. 22/22 Thank you