|
|
I’ve found that more and more Trojans/worms/viruses/hackers are using ARP spoofing to inject miscellaneous code into Web pages. They’re able to do this using the following technique:
1)Â Â Â Â An attacker scans a subnet, finds a vulnerable host, and hacks into it.
2)Â Â Â Â The attacker installs a Trojan on the victim’s host.
3)Â Â Â Â The Trojan sends spoofed ARP packets to gateways and other computers on the same subnet.
4)Â Â Â Â When the other hosts on the subnet receive the spoofed ARP packets, they begin routing traffic through the victim’s host.
Here is a diagram depicting the network before ARP spoofing:
[gateway] <-> [host]
Here is a diagram depicting the network after ARP spoofing:
[gateway] <-> [victim's host] <-> [host]
5)Â Â Â Â The Trojan software installed on the victim’s host relays traffic to/from hosts on the subnet and inserts malicious code into HTTP responses. The malicious code injected into HTTP responses is designed to exploit Internet Explorer and to download and install Trojan software. The installed Trojan software might repeat the same process, further penetrating the network.
So, although your Web server may not have been hacked, your users might still fall victim to browser-based attacks carried out by the injection of malicious code via ARP spoofing. The best way to protect against this is to configure static ARP table entries for gateway devices on all hosts. I recommend that all network and server administrators do this.
|
|
While you can prevent ARP spoofing by the use of static, non-changing ARP entries (each entry maps a MAC address to corresponding IP address), this is not practical on a large network, due to the large overhead of keeping ARP tables up to date. Therefore another method, such as DHCP Snooping, can be utilised on larger networks. Via DHCP, the network device keeps a record of the MAC addresses that are connected to each port, so it can readily detect if a spoofed ARP has been received. This method is implemented on networking equipment by vendors such as Cisco, Extreme Networks and Allied Telesis. – Source : http://en.wikipedia.org/wiki/ARP_spoofing
Hmmm, Please publish the names/links of the malware analysis that McAfee has published that detail the use of ARP the way you describe. This should be a big news item, but you’ve published no details for IDS signature development etc.
Nice work though!
Regards,
Pat
Submit your own comments / message for this post