Hot answers tagged

17

Packet checksums are not cryptographic measures, and are not intended to be a security feature. Anyone (even an attacker) can calculate the checksum for a packet containing anything, and there's no secrets/keys involved in the calculation. Checksums are intended to catch errors during the transmission of the packet: flipped bits, miscommunication, etc. ...


8

By their function, a switch will only forward packets to the port where the destination computer (identified by it's MAC address) is. For this reason, they are said to mitigate sniffing attack. However, switches are not security devices but network devices. In order to know where a specific computer is, they have to learn where they are. For this, they ...


7

Get to the roots ! If you know what ARP does, things will be clearer. On a subnet (machines plugged into the same set of hubs and switches), the machines talk to each other with MAC addresses: the MAC address uniquely identifies each ethernet/WiFi card. Machines, a priori, do not know MAC addresses; they just know IP addresses. So, when machine A wants to ...


6

If you have a https page, but load some assets (JavaScript) over plain http, then: Many browsers (recent Chrome versions, maybe also Firefox) won't even load the script by default an attacker can intercept the script, and replace it with — for example — another script that will simply copy the entire <body> contents of your https page, rendering ...


6

Not only can checksums be recomputed after a packet has been modified. This happens during normal operation of IP. It is not at all unusual for a router to have to update three different checksums on a packet before it will be able to forward an unmodified payload. The three checksums I am referring to are on the Ethernet, IP, and transport layers of the ...


5

First, let's clarify what is meant by a static arp entry. The Address Resolution Protocol is used to map the layer 2 address to the layer 3 address, typically this is Ethernet and IP. A static arp entry means that you always expect a specific IP to be at a given hardware address. With a default Windows or Linux implementation, you will be using a TCP/IP ...


5

The attacker can try to flood the MAC table of the switch, and then the switch could fall down in "hub" mode. Then the switch would send the packets of Alice and Bob on all port. So Eve could sniff their network packets. Another way to hack is to poison the switch MAC table. If Eve knows the MAC address of Alice and Bob, Eve could tell the switch that he ...


5

When ARP Poisoning You are poisoning the ARP tables. If computer 10.1.1.1 needs to get to computer 10.1.1.2, it keeps the MAC address in its ARP tables. ARP is a trusting protocol, which means when a computer responds to a ARP request, there is nothing requiring its response to be correct and no mechanism for verifying it is correct. So here's the game ...


4

Suggest you research the latest Cisco APs. I believe these devices are able to isolate each wireless client from each other and from the network. All client traffic is routed instead of switched. You can then setup ACLs to keep WiFi attached clients from reaching anything they should not have access to. Also most enterprise-grade switches support ...


4

You are assuming that once you are authenticated to the Access Point that you can automatically see all WiFi traffic from all nodes in the clear. In WPA, each node is given their unique key with which to communicate with the Access Point.


4

Question is : why the ARP modified versions hasn't been used on large scale yet ? What is the cost of addressing this versus the risk? ARP is a local subnet issue. If someone is already successfully on your LAN you probably have a much bigger problem because they can still do attacks at higher layers of the communications stack. Is this where you want ...


4

Configure your switch to use Private VLANS (PVLANS). PVLANS basically say that physical ports Gi1/1 - 47 can only talk to physical port Gi1/48 (where your gateway is). Even things on the same subnet must go through the gateway to talk. In a setup with N hosts there is generally no reason for the hosts to talk so a PVLAN config is optimal for security. ...


4

Your assumption is mostly correct but not completely. As you suspect, cases (b) and (c) are the same because it is of no relevance whether the switch is built in to some other hardware or standalone. So I will call both cases (b). An ethernet switch will normally optimize the traffic flows so that packets are not sent to ports where they don't need to go. ...


4

The detect ARP spoofing, you typically capture packets and look for gratuitous ARP advertisements. That way you can also see what device is doing the spoofing. To defend, you need to configure your device/network with static ARP assignments.


4

Short answer: Switches only help when upgrading from a hub, don't add it to your network unless you need it. M'vy and GreatSeaSpider have given great answers!, I will try to simplify and show visually what they mean. It's all about collision domains! Image A explains what each device does, and Image B shows how that affects a network. With a hub, any ...


4

You can do this using DNSchef. It is described here at the Kali Webpage. You can also find a useful documentation at the developers webpage. When it gets more complex I suggest you to use configuration files instead of command line switches.


3

Regardless of where you are connected, if you are able to do ARP poisoning, that is you let all traffic headed towards the gateway of the network come to you, you will get all traffic and you will be able to intercept it. Q: The router would need to forward the wrong information about its own IP. Doesn't it recognize? In ARP poisoning, you are not ...


3

Actually, I disagree with tylerl's answer. It is indeed difficult to hide our IP from other hosts on a LAN, it's very possible. Because you're mentioning netcut (a tool that works by using ARP poisoning), I think you have the following setup: You trying to use the Internet. Router giving you access to the Internet. Other hosts on the same LAN. Some ...


3

There is a possibility to encrypt the connection to the proxy, there was a question on this site.Please find the link mentioned below.However the methods mentioned may not work at all times. Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection? To answer your query regarding implementing this on the network infrastructure: ...


3

You can't protect a layer-2 network from ARP spoofing. And a single wireless AP consists of a single wireless layer-2 network. I do not know if your wireless AP acts as a bridge (which would propogate the "original" MAC address used by the client wireless card) or a router (which would retransmit using the AP's MAC address). If it's in router mode, then ...


3

Is there a way to encrypt traffic to avoid MITM attacks? Many! Almost every good method for this involves a public/private keypair. To ensure that you are corrected to the correct endpoint, you must know trust the other side's key. If you don't somehow verify the key on the other end of the connection, the value is very limited as an attack can ...


3

According to my research on the subject, and running tests there are no quick fixes for tracking the source individual perpetrating this type of attack because of the nature of it. Meaning tracking, but not filtering/blocking. The attack method itself is basically easy to do compared to the scale of other types of attacks out there due to fundamental flaws ...


3

case 1 - Will only tell the target that you are the router. If you don't tell the router that you are the target, the router will send packets to the target, the target will send the reply to you, and it will stop there. This will effectively DOS the target because you aren't forwarding the packets to the router. case 2 - Is the complete ARP spoofing ...


3

PART 1: Generic explanation, unnecessary to read if you have read the question. The first (how does the packet arrive at the attacker): Victim sends a packet with source IP '192.168.1.3' and source MAC '00:00:00:00:00:03' to destination IP 'DEST' and destination MAC '00:00:00:00:00:01'. Where 'DEST' is some external IP like '47.32.1.6' The router ...


2

I have found a solution to this problem. I enabled packet forwarding on my kernel and the attack works great now. sudo sysctl -w net.inet.ip.forwarding=1 Hope this helps anyone in the future.


2

ARP poisoning causes the traffic between those hosts to be forwarded through you, as part of the man in the middle attack. This causes performance degradation on the targets for a few reasons: There is increased latency due to the added network hop. Your network card has to send and receive 2 to 4 times as much data as normal, since you're acting as a ...


2

Is your computer in the same subnet than the target devices? Because ARP only works between devices in the same IP subnet. But if the two IP Addresses are on different subnets, the device will follow a completely different logic: it will look in its routing table for a route to the destination network, and then it will send its packet to the appropriate ...


2

May be I am wrong, but try to use wireshark Also I think that this might be useful http://compnetworking.about.com/od/networkprotocolsip/f/convertipmacadd.htm


2

Sorry, no. As a rule, your IP is visible to anyone on your LAN, which sort of is the definition of what a LAN is.


2

Passive-only attack scenarios tend to be rather specialized. Mostly, they involve radio links; the attacker can play with a homemade reception antenna, but is not rich enough to build an emitter which can drown out the genuine signal. This rarely applies to the Internet; this is more relevant to military on-field communications. It could be argued that ...



Only top voted, non community-wiki answers of a minimum length are eligible