3 - Network- & Transport-Layer Security (Eavesdropping)

Question 1

Describe the Man-in-the-Middle attack based on ARP.

Answer 1

ARP messages are kept in ARP cache of hosts.

1. Alice broadcasts an ARP request to find Bob.
2. Attacker respond to Alice saying it is Bob, but giving its own MAC.
3. Alice updates her ARP cache and send messages to attacker.
4. Attacker redirects Alice’s and Bob’s messages using ARP spoofing.

Question 2

MitM attack is not a thread because the attacker must be inside the local network. Explain why this is false.

Answer 2

It is false because an external attacker must only find a single vulnerable host within the local network to become an insider.

Question 3

What are other attacks based on ARP?

Answer 3

ARP Cache Overflow: flood host with ARP replies.
ARP Storm: poison the caches with broadcast addresses (bring network performance down).
DoS: update ARP cache for all hosts with non-existing MAC addresses.

Question 4

What are the defenses against ARP poisoning?

Answer 4

Switches can use IP-MAC-Port binding, accepting only fixed MAC addresses with fixed IPs at fixed Ethernet ports.