2.5 - On-Path Attacks

Communication Between Devices

  • Much of communication across networks occurs between two devices.

    • Example: Device A communicates with Device B.

    • Device B communicates back to Device A.

On-Path Attacks

  • Attackers aim to monitor and potentially alter communications between devices through on-path attacks.

    • Definition: An on-path attack is when an attacker positions themselves between two devices communicating online to observe and manipulate traffic.

    • These attacks can operate unnoticed by the end stations involved in the communication.

    • Security software on these devices may not detect that an on-path attack is occurring.

ARP Poisoning/Spoofing

  • A prevalent form of on-path attack is ARP (Address Resolution Protocol) poisoning or spoofing.

    • Definition: ARP poisoning allows an attacker to intercept traffic between devices on a local network by sending false ARP messages.

    • ARP does not incorporate security measures, making it vulnerable to exploitation.

Normal ARP Communication Example

  • Devices in a local network:

    • Laptop:

    • IP Address: 192.168.1.9

    • MAC Address: Ends in 38 delta 5

    • Router:

    • IP Address: 192.168.1.1

    • MAC Address: Ends in bravo, bravo, fox, echo

  • ARP Request Process:

    • The laptop needs the router's MAC address to send data to another subnet.

    • The laptop sends an ARP request to find the MAC address of the router (IP: 192.168.1.1).

    • The router broadcasts a response back to the laptop, providing its own MAC address.

  • ARP Cache:

    • The laptop stores this IP-MAC address pair in its local cache for future communications.

Exploitation via ARP Spoofing

  • Attack Scenario:

    • Attacker IP Address: 192.168.1.14

    • Attacker MAC Address: Ends in echo, echo, fox, fox

    • The attacker sends a forged ARP response directly to the laptop without the laptop requesting it.

    • The forged ARP claims the attacker's MAC address corresponds to the router’s IP address (192.168.1.1).

    • The laptop updates its ARP cache, associating the router’s IP with the attacker’s MAC address.

  • Result of ARP Spoofing:

    • The laptop sends its data destined for the router to the attacker’s device instead, allowing the attacker to intercept and observe all traffic.

    • The attacker may also spoof the router to the laptop to complete the intercept.

On-Path Browser Attack

  • Alternative Attack Scenario:

    • An attacker has compromised Device A (e.g., a laptop) with proxy software.

    • The software functions as an intermediary, allowing the attacker to oversee traffic while making the interaction seem normal.

    • Users may connect to their bank or other services without realizing the proxy is capturing their data (login credentials, sensitive information).

  • Implications:

    • The proxy can potentially access banking information directly from the user’s session and manage funds without needing to report back to the attacker.

Wireless Evil Twin Attack

  • Attack Method on Open Wireless Networks:

    • Attackers can set up an illegitimate access point that mirrors a legitimate SSID (Service Set Identifier).

    • Characteristics of Evil Twin Access Point:

    • Same SSID as a legitimate access point.

    • Identical security settings to trick users.

    • Potentially a captive portal that resembles the legitimate one to deceive users further.

  • Method of Operation:

    • Attackers may enhance the transmission power of their access points to overpower legitimate signals.

    • Users unknowingly connect to the attacker's access point and expose themselves to eavesdropping and data modification.

Best Security Practices

  • Recommendations for Users:

    • Always connect using encrypted channels (e.g., HTTPS for websites).

    • Utilize a Virtual Private Network (VPN) when using public networks to secure communications and protect sensitive information.