4.2 - ARP and DNS Poisoning & 4.2 - Rogue Services

Spoofing and poisoning

• Pretend to be something you aren’t

– Fake web server, fake DNS server, etc.

• Email address spoofing

– The sending address of an email isn’t really the

sender

• Caller ID spoofing

– The incoming call information is completely fake

• On-path attacks

– The person in the middle of the conversation

pretends to be both endpoints

DNS poisoning

• Modify the DNS server

– Requires some crafty hacking

• Modify the client host file

– The host file takes precedent over DNS queries

• Send a fake response to a valid DNS request

– Requires a redirection of the original request or the

resulting response

– Real-time redirection

– This is an on-path attack

Rogue DHCP server

• IP addresses assigned by a non-authorized server

– There’s no inherent security in DHCP

• Client is assigned an invalid or duplicate address

– Intermittent connectivity, no connectivity

• Disable rogue DHCP communication

– Enable DHCP snooping on your switch

– Authorized DHCP servers in Active Directory

• Disable the rogue

– Renew the IP leases

Rogue access points

• An unauthorized wireless access point

– May be added by an employee or an attacker

– Not necessarily malicious

– A significant potential backdoor

• Very easy to plug in a wireless AP

– Or enable wireless sharing in your OS

• Schedule a periodic survey

– Walk around your building/campus

– Use third-party tools / WiFi Pineapple

• Consider using 802.1X (Network Access Control)

– You must authenticate, regardless of the connection type

Wireless evil twins

• Looks legitimate, but actually malicious

– The wireless version of phishing

• Configure an access point to look like an existing network

– Same (or similar) SSID and security settings/captive portal

• Overpower the existing access points

– May not require the same physical location

• WiFi hotspots (and users) are easy to fool

– And they’re wide open

• You encrypt your communication, right?

– Use HTTPS and a VPN

On-path network attack

How can an attacker watch without you knowing?

– Formerly known as man-in-the-middle

• Redirects your traffic

– Then passes it on to the destination

– You never know your traffic was redirected

• ARP poisoning

– On-path attack on the local IP subnet

– ARP has no security

Other on-path attacks

• Get in the middle of the conversation and

view or change information

– Session hijacking

– HTTPS spoofing

– Wi-Fi eavesdropping

• Encryption fixes most of these situations

– You can’t change what you can’t see