ARP spoofing and rogue DHCP attacks for Network+

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A workstation's ARP cache entry for its gateway now maps to an attacker's hardware address, and the attacker reads the traffic before forwarding it. Which of the following explains why the entry was installed?

   Right. In the game that’s Renown for your Network Security building.

   Not that one: B is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

   Your answerA.The switch flooded the forged ARP reply out of every port.How the reply travelled across the switch does not explain why the workstation trusted it. Even a reply delivered only to that one port would have been accepted, because the protocol gives the host no way to verify the sender; the weakness is in ARP, not in the switch's forwarding.The answerB.ARP is stateless and does not authenticate the replies it processes.MITRE ATT&CK T1557.002 states that 'the ARP protocol is stateless and does not require authentication.Your answerC.The DNS resolver returned the attacker's address for the gateway's name.DNS maps hostnames to IP addresses. The entry that changed is the mapping from the gateway's IP address to a hardware address, which lives in the ARP cache and is never produced by a DNS lookup.Your answerD.The DHCP server handed out the attacker's address as the gateway.If DHCP had supplied a wrong gateway, the workstation's default gateway IP address would be the attacker's. Here the gateway IP is unchanged and still maps correctly in DNS and DHCP terms; what has been corrupted is the ARP cache entry that says which hardware address that IP belongs to.

   Show the full explanation and doc quotes

   Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.' Because a host accepts a reply it never asked for and cannot check who sent it, an attacker's reply mapping the gateway's IP to the attacker's MAC is installed, and the host's traffic to the gateway goes to the attacker, who can read it and forward it on.

   Written from attack.mitre.org/techniques/T1557/002/

2. A switch forwards IP address lease offers only from the port facing the company's addressing service and drops any such offers arriving on user ports. Which of the following threats does this block?

   Right. In the game that’s Renown for your Network Security building.

   Not that one: B is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

   Your answerA.Rogue access pointA rogue access point is an unauthorized wireless device attached to the network. It may bring its own DHCP service, but the control described targets lease offers on any port and does nothing about the access point's backdoor into the network.The answerB.Rogue DHCP serverRFC 7513 describes switch ports marked as trusted for DHCP: only devices attached to them are permitted to send DHCP server-to-client messages, and by default a port is not trusted.Your answerC.MAC floodingMAC flooding sends frames with thousands of fabricated source addresses to overflow the switch's address table. Filtering DHCP offers by port does not limit how many addresses a port may introduce.Your answerD.ARP spoofingARP spoofing forges ARP replies to map an IP address to the attacker's hardware address. The switch here inspects only DHCP server messages, so forged ARP replies pass untouched.

   Show the full explanation and doc quotes

   Lease offers from any other port, such as a user's port with an unauthorized DHCP server on it, are dropped, so clients only ever receive the legitimate server's configuration.

   Written from www.rfc-editor.org/rfc/rfc7513.html

3. An insider's rogue DHCP server hands out leases naming a nonexistent default gateway, and clients that accept them can no longer reach anything beyond their own subnet. Which of the following attack types is this?

   Right. In the game that’s Renown for your Network Security building.

   Not that one: C is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

   Your answerA.On-path attackA rogue DHCP server becomes an on-path attack when it names the attacker's own host as the gateway, so traffic flows through it. A nonexistent gateway carries no traffic at all; the clients are simply cut off.Your answerB.VLAN hoppingVLAN hopping lets an attacker send or receive traffic on a VLAN the attacker's port is not assigned to. Nothing here crosses VLANs; clients lose their route off the subnet.The answerC.Denial-of-serviceRFC 3118 describes the threat to a DHCP client as a rogue server that provides incorrect configuration information, with the motive being either a man-in-the-middle attack or a denial of service.Your answerD.DNS poisoningDNS poisoning plants false records so names resolve to the wrong addresses. These clients cannot reach any off-subnet address, whether looked up by name or typed directly, because they have no working gateway.

   Show the full explanation and doc quotes

   A gateway that does not exist cuts clients off from every other network without putting the attacker in the path, so the effect is a denial of service.

   Written from www.rfc-editor.org/rfc/rfc3118.html