Re: More on ARP cache poisoning

[ron () GWMICRO COM (Ron Parker)]

At 02:29 PM 2/2/2000 GMT, Bryce Walter wrote:
> For remote hosts, the computer is going to arp for the defualt gateway
> instead of the destination IP.  If you poisoned the ARP cache for the entry
> of the default gateway, all packets for any remote computers would be sent
> to you.  This would probably be noticed pretty quickly when nothing seems to
> "work" on the target computer.  You could try to avoid this by enabling
> routing on your box to get the packets that you don't care about to their
> real desinations.

Having just fallen victim to the bad router configuration of a clueless
"administrator" who happens to have the same DSL provider as I do, I can
testify that the similar but slightly different attack outlined in
http://www.l0pht.com/advisories/rdp.txt will work quite well, too, at
least against Win98 boxes. It may even work without DHCP being enabled
on the target machine, as I don't believe it is enabled on the machine
on which I saw the bad behavior.

My DSL provider (GTE) uses Fujitsu Speedport modems and other hardware;
your mileage may vary.

--
Ron Parker
GW Micro, Inc.
Voice 219-489-3671
Fax 219-489-2608