ARP Spoofing or ARP Poisoning

Explanation of the ARP Protocol

Before we start explaining the dangers of an ARP spoofing attack, let’s understand ARP protocol. It refers to Address Resolution Protocol and is the protocol accountable for the efficacious delivery of the communicated messages on the targeted device that would be supposed to be present anywhere on the network.

The main task of the ARP protocol is to inter-translate IP and MAC addresses. Most internet-based devices take the help of ARP protocol to get linked with a router or gateway so that internet connectivity is possible. ARP will make the internet understand that a device is trying to communicate using it.

‍

ARP Spoofing or ARP Poisoning - What is it? 

As ARP is an integral part of internet-based communication, it’s crucial to get familiar with the meaning and significance of ARP spoofing. It involves corruption of APR protocol in a way that a hacker/attacker can decode the information exchange happening across the network and amongst the devices. As ARP protocol is exploited, it’s also known as ARP Poisoning.

There are two approaches to carrying out an ARP attack. 

In the first approach, an attacker will wait for a while to access the ARP requests related to a specific device. Once the ARP request is received, a quick response is issued. This is a stealth approach and won’t be noticed immediately by the network. As far as its impact is concerned, it’s not that much damaging and its scope is limited.

In the second approach, hackers disperse an unsought message that is commonly known as “gratuitous ARP”. This is an immediate-impact delivering approach and can affect tons of devices at a time. But, take note of the fact that it will also create heavy network traffic that will be tough to handle. 

What is the aim of an ARP Spoofing Attack

The aim of conducting such an attack depends on the intention of the hacker. Some hackers can use it to create a foundation for further harmful attacks or a few might use it to access communication happening over one device. 

A few common aims are:

• To overflow the targeted network with enormous ARP reply messages
• To pack the MAC address table with fake MAC addresses
• To link a validated IP address with a bogus MAC address
• To throw endless ARP requests so that network hosts become packed

‍

ARP Spoofing - Step by Step Explanation

The attack follows as mentioned below:

Step 1:

At first, the ill-intended hacker will access the targeted network and scan it extensively so that IP address-related information can be extracted. The attacker must extract this information from a minimum of two devices that are at the sender and receiving ends. For example, a router and a workstation.

Step 2:

Once the IP address details are obtained, the hacker uses a tools like Driftnet or Arpspoof so that the actual ARP protocol can be forged or altered. 

Step 3:

This altered or forged IP address makes others believe that the unaltered MAC address is linked with both (compromised/actual and forged/fake) addresses. This way, it misleads both the workstation and the routers, allowing the hacker to intrude into the network.

Step 4:

As a part of request processing, both the routers and workstations update the related ARP’s cache data as per the MAC address of the attacker’s device. Hence, a communication bridge with the corrupted device is built. 

If successful, the hacker becomes a part of the entire communication-taking place. Hacker sits in the middle. Hence, this attack is a part of the MiTM attack.

What is this attack used for?

ARP Spoofing has high potential and can help an attacker to cause severe damage to the aimed device/network. Here are a few key usages of the ARP attack.

• ‍MiTM

This is the most customary use of MiTM attacks and is certainly the most damaging one. To carry out this attack, the hacker will use fake ARP responses. In general, the compromised IP is the subnet’s default gateway. Once the fake ARP response is forwarded, the targeted machine will start communicating with the MAC address of the attacker’s device. 

The victim device, thereafter, will start forwarding the info/traffic wrongly to the attacker’s device/machine, considering it a part of network channel. To carry out this attack, few attackers even use tools like an Ettercap that help them disguise themselves as a proxy or gain access to the altered information that is supposed to be forwarded to the aimed endpoint. 

If the hacker is utterly skilled, s/he can easily merge ARP poisoning and DNS poisoning. If that happens, the impact of the MiTM attack will increase and more damage will occur. 

• ‍DDoS attacks

It refers to an attack wherein a particular network is overflown with responses or traffic so that one or more victims won’t be able to access it. In the case of ARP spoofing, the threat actor floods the network/channel with ARP responses that are capable of generating numerous bogus IP addresses with a certain MAC address. Once it happens, the device will be jammed and won’t be accessible by other users. This attack is often known as ARP flooding. 

• ‍Session hijacking

Structure-wise, this type of threat seems very similar to the MiTM attack. However, in it, the hacker won’t direct the traffic from the impacted device to the final destination. In place of it, he will seize the original TCP number of the attacked device and use it to act like a verified resource. Using this new identity, the hacker then approaches the final destination. 

‍

ARP Spoofing Detection 

Finding out the issue early and adding countermeasures for its avoidance are the best ways to keep the damage under control. Gladly, it’s not tough to perform ARP spoofing detection. To help you out, here are a few tips:

• There are many commercial tools offered that will spot the presence of ARP cache in no time. If you’re not willing to use a software or tool, just pay attention to the ARP tables of your system.
• It’s easy to do. All you need to do is open a cmd window and give the “arp -a” command. Once the command is given, you’ll have an extensive list of presently used IP-to-MAC address mappings. From the list, you can make out the status of the ARP response and spot a bogus one. However, you need to have a deeper understanding of ARP responses to make out this. 
• You can also use tools like X-ARP and arpwatch that will help you watch out for the present situation of the network and will immediately inform the admin if any infected or fake ARP response is present. But, take note of the fact that there are certain false-positive possibilities. You might witness a wide range of unwanted notifications as well. Hence, manual verification is required. 

‍

How to Prevent:

You cannot take up ARP spoofing casually as it could have high-impact threats to the devices and even, the enterprise network. See a few expert-tested and verified ARP spoofing prevention methods to stay safe against it:

• Start using VPN as this advanced technology makes IP addresses hidden from everyone. As the attacker utilizes an IP address for ARP spoofing, he won’t succeed when access to the IP is constrained. Other than hiding the real IP address, it makes the traffic utterly encrypted that further enhances the security of the devices.
• One viable way to prevent ARP attacks is to use static ARP as such an ARP stop device to access or process 
• ARP responses are linked with that IP address. Using a static ARP protocol is crucial if the same router is used for the connection. This way, you will prevent anyone from accessing an ARP that is used repeatedly.
• Implementing packet filtering can be proved highly useful as it will help in early detection of poisoned ARP packets and eliminate them before they reach the network. This is one of the most useful anti ARP spoofing tools that deliver satisfactory information.
• Make sure that you’re running a spoofing attack test at regular intervals. This helps you to do early detection of any trouble-causing vulnerability and fix it when there is time. 
• When port security is of higher grade, the odds of ARP poisoning attacks are low. So, make sure that you’ve enabled port security on the switch. Doing so is an easy job. The only thing that one has to do is allow the switch port to access only one MAC address at a time.
• One workable ARP spoofing prevention technique is using network isolation. As we all know, ARP messages tend to travel up to the local subnet. Beyond that, it won’t be accessible. Hence, a network that features well-defined boundaries. This way, an attack affecting one subnet will not harm other devices.

Final Say

With the cyber world full of risks, there is no excuse to be lenient and have a laid-back attitude when it comes to cyber security. ARP spoofing is a serious cyber vulnerability and can harm beyond one’s understanding. Hence, adopt the best preventive methods and have a proactive approach to resolve this issue in the infancy stage.