Re: fooling hubs [ARP Spoofing]

[tschroed () ZWEKNU ORG (Trevor Schroeder)]

On Fri, 4 Feb 2000, Robert van der Meulen wrote:

> Did you ever try taking on the mac adress of somebody else (near you, in a
> geographical sense), and tcpdumping the connection ?

Let's redefine near to be "near you, in a network sense."  ie, someone on
the same LAN segment.  Near on the network may not mean near,
geographically.  After all, with 100 meter runs, you could have two
devices on the same physical net, but 200 meters apart.  Add in repeaters
or, god forbid, fiber, and they could be even further yet.  Geographic
nearness and network nearness do not directly correspond.

> Chances are that you'd be getting inbound traffic, aimed at the other person,
> but arriving at your pc - in my opinion, _that_ is a bug :)

I don't think it is.  ARP is designed to be simple.  It exceeds at that.
Just looking at the layout of the frame is enough to tell you how it
works.  It's simple enough that even the dumbest embedded device can use
it. etc. etc.

The problem arises when you expect it to be secure.  Historically, LANs
have not been considered anything like secure.  I mean, who cares if you
can do ARP redirection on a *shared media* network.  It really doesn't
gain you much.  So why go to all the effort of making ARP an authenticated
protocol?

Now in the hairy scary days, there needs to be some authentication
mechanism.  I still don't it's needed at the ARP level.  Use network layer
authentication and encryption (ie, IPsec) if you want to verify that
someone is who they say they are and that the communication is truly
private.

For the truly paranoid, you can always do network segmentation, VPNs, and
static ARP entries.  And of course, network-layer encryption/auth.
..........................................................................
: "I knew it was going to cost me my head and also my swivel chair, but  :
: I thought: What the hell--better men than I have risked their heads    :
: and their swivel chairs for truth and justice." -- James P. Cannon     :
:........... http://www.zweknu.org/ for PGP key and more ................: