Detecting ARP Spoofing Attacks

re: Detecting ARP Spoofing Attacks

CurtWilson — Sat, 07 Jul 2007 01:07:52 GMT

I believe there was some malware that was able to use javascript hackery to redirect and proxy HTTPS in a full-screen frame. The average user would not notice it. I believe I saw this demonstrated at BlackHat 06/Vegas and the only way you could tell was either by looking at the page source or noticing the small thin border around the page. So, I'd speculate that it's possible that by utilizing that technique + the ARP spoofing technique that you could redirect through the attackers local malicious proxy. I have not tested this.

re: Detecting ARP Spoofing Attacks

Jordan — Fri, 13 Jul 2007 21:32:27 GMT

Curt: the malware can only take that approach if it's running on the local host and then by hooking into the browser or network stack. SSL security is end-to-end on the network so nobody anywhere in between can MITM it unless they've got a root-signed cert for the domain in question, or the user ignores a browser warning.

Another way of detecting ARP poisoning using only built in tools or easy to script tests would be to ping all possible hosts on the local subnet (or broadcast address if that works -- I don't recall what conditions that will work with firewalls, different network stacks, etc, so that might not work) and then query the local arp cache to see if the "gateway" shows up for any other IPs on the network. It's not foolproof as I can think of a couple of ways the attacker could evade detection if he knew about it beforehand, or ways that might cause the router's mac to show up for other addresses, but generally speaking it should work fairly well. And it's an easy check to implement. I bet you it would have detected this particular malware fairly, showing the mac of the real machine's IP and the gateway IP as well.

re: Detecting ARP Spoofing Attacks

James — Wed, 01 Aug 2007 17:32:05 GMT

I just noticed something similar on my university's campus network: in my case, it was a reference to a JavaScript file inserted at the top of Web pages. I haven't seen anything about this exploit anywhere else. It's a pretty scary exploit, since fundamentally you are relying on the network administrator to keep the network from being compromised--there's not much you can do if the network itself goes bad.