Chapter 06 · Part II · Defending the network

Attacks on the local network

The protocols that glue a local network together were designed for a room full of colleagues. ARP and DHCP believe whoever answers first, and nothing in either protocol proves who sent a message. This chapter is about what that trust costs, and the switch, Wi-Fi and encryption features that take it back.

1982the year ARP was published (RFC 826, November 1982), with no way to check who sent a reply
3ARP probes a host sends before using an address, under IPv4 Address Conflict Detection (RFC 5227)
PMFprotected management frames: required by WPA3, so forged Wi-Fi control messages can be told from real ones

Common mix-up: an attacker on your local network does not need to break encryption to cause harm, and encryption does not stop them from redirecting traffic. What encryption does is make the redirected traffic useless to them: they see ciphertext and cannot forge the certificate that would let them read it.

Read first: this chapter assumes how switches learn MAC addresses from Ethernet, MAC & switches, how a device gets its address, gateway and DNS server from DHCP & DNS, and the layout of a typical home network.

The shape of the problem

A room that believes everyone

On a local network, a device that wants to reach the gateway asks "who has this IP address?" and remembers whichever answer comes back. A device that needs an address asks for a DHCP server and takes the first offer. Neither protocol carries a signature. That is why MITRE ATT&CK lists both ARP cache poisoning and DHCP spoofing as ways an intruder already inside a network can put itself on the path between other devices and the gateway.

The defenses work at three levels:

  • The switch checks the claims. DHCP snooping marks only the ports where real DHCP servers live as trusted and drops server messages from every other port. It also builds a table of which address was handed to which port. Dynamic ARP Inspection then checks every ARP reply against that table and drops the ones that do not match.
  • The port checks the device. IEEE 802.1X keeps a switch port or Wi-Fi association closed until the device authenticates to a central server. WPA3 adds protected management frames, so forged disconnect messages are ignored.
  • The traffic protects itself. TLS, HSTS and VPNs mean that even a device that does get on the path sees only ciphertext and cannot impersonate the server without a valid certificate (Chapter 03).

Detection helps too: IPv4 Address Conflict Detection (RFC 5227) has hosts probe before they use an address and defend it afterwards, and a sudden change in which MAC address answers for the gateway is a classic thing to alert on (Chapter 17).

Still being written

The rest of this chapter

This chapter is being finished. Still to come are a narrated walkthrough, an ARP cache simulator where you can switch on each defense and see which ones stop redirection and which only make it useless, a DHCP race between a real and a rogue server, and full sections on 802.1X, WPA3 and evil-twin access points.

Firewall zones and VLANs are in Chapter 05; DNS spoofing at the resolver is in Chapter 07; VPNs and zero trust are in Chapter 11.

Sources

Go to the source

  1. RFC 826: An Ethernet Address Resolution Protocol (November 1982).
  2. RFC 5227: IPv4 Address Conflict Detection.
  3. RFC 6105: IPv6 Router Advertisement Guard.
  4. MITRE ATT&CK T1557.002 ARP Cache Poisoning and T1557.003 DHCP Spoofing.
  5. IEEE, 802.1X: Port-Based Network Access Control.
  6. Wi-Fi Alliance, Wi-Fi security (WPA3 and protected management frames).
  7. NIST SP 800-153: Guidelines for Securing Wireless Local Area Networks.