1. The Inherent Insecurity of Ethernet An Introduction to ARP Poisoning by Stephen Roux 5/7/20071sproux/InsecurityOfEthernet

2. About ARP ARP = Address Resolution ProtocolARP = Address Resolution Protocol Directs traffic within a subnetDirects traffic within a subnet Connects network and data link layersConnects network and data link layers No built-in securityNo built-in security 5/7/20072sproux/InsecurityOfEthernet

3. How ARP Works Source broadcasts questionSource broadcasts question –Who has IP address 192.168.38.17? Destination respondsDestination responds –I do, my MAC address is 00-d1-b7-6e-ca-4b Source adds mapping to its ARP cacheSource adds mapping to its ARP cache C:\>arp -a Interface: 192.168.38.62 --- 0x4 Internet Address Physical Address Type 192.168.38.17 00-d1-b7-6e-ca-4b dynamic 5/7/20073sproux/InsecurityOfEthernet

4. Caching ARP mappings are kept for 2-20 minutesARP mappings are kept for 2-20 minutes Improves performanceImproves performance –No need to waste packets on mappings that don’t change often 5/7/20074sproux/InsecurityOfEthernet

5. Stateless Protocol ARP does not match requests to repliesARP does not match requests to replies Unsolicited replies can be sentUnsolicited replies can be sent Improves performanceImproves performance –System with newly allocated IP address can announce itself to the subnet –Works well with DHCP Immediately modifies the ARP cacheImmediately modifies the ARP cache 5/7/20075sproux/InsecurityOfEthernet

6. Why This Is Bad An attacker can falsify ARP messagesAn attacker can falsify ARP messages Poison the cache of a target victimPoison the cache of a target victim Redirect trafficRedirect traffic –DOS –MITM 5/7/20076sproux/InsecurityOfEthernet

7. Current Solutions Switch/router settingsSwitch/router settings –Advanced features –Can protect only if correctly configured Network monitoringNetwork monitoring –Difficult to tell the difference between legitimate ARP traffic and malicious Client-basedClient-based –Static ARP tables –Block inconsistencies 5/7/20077sproux/InsecurityOfEthernet

8. Future Solutions Design secure ARPDesign secure ARP May need to be significantly modifiedMay need to be significantly modified –Add cryptographic authentication –Must not significantly slow down the network –Combine ideas into new standard One idea:One idea: –“An Efficient Solution to the ARP Cache Poisoning Problem” by Vipul Goyal and Rohit Tripathy 5/7/20078sproux/InsecurityOfEthernet