Tag Info

Hot answers tagged

17

Packet checksums are not cryptographic measures, and are not intended to be a security feature. Anyone (even an attacker) can calculate the checksum for a packet containing anything, and there's no secrets/keys involved in the calculation. Checksums are intended to catch errors during the transmission of the packet: flipped bits, miscommunication, etc. ...


6

If you have a https page, but load some assets (JavaScript) over plain http, then: Many browsers (recent Chrome versions, maybe also Firefox) won't even load the script by default an attacker can intercept the script, and replace it with — for example — another script that will simply copy the entire <body> contents of your https page, rendering ...


6

Get to the roots ! If you know what ARP does, things will be clearer. On a subnet (machines plugged into the same set of hubs and switches), the machines talk to each other with MAC addresses: the MAC address uniquely identifies each ethernet/WiFi card. Machines, a priori, do not know MAC addresses; they just know IP addresses. So, when machine A wants to ...


6

Not only can checksums be recomputed after a packet has been modified. This happens during normal operation of IP. It is not at all unusual for a router to have to update three different checksums on a packet before it will be able to forward an unmodified payload. The three checksums I am referring to are on the Ethernet, IP, and transport layers of the ...


5

First, let's clarify what is meant by a static arp entry. The Address Resolution Protocol is used to map the layer 2 address to the layer 3 address, typically this is Ethernet and IP. A static arp entry means that you always expect a specific IP to be at a given hardware address. With a default Windows or Linux implementation, you will be using a TCP/IP ...


5

The attacker can try to flood the MAC table of the switch, and then the switch could fall down in "hub" mode. Then the switch would send the packets of Alice and Bob on all port. So Eve could sniff their network packets. Another way to hack is to poison the switch MAC table. If Eve knows the MAC address of Alice and Bob, Eve could tell the switch that he ...


4

Question is : why the ARP modified versions hasn't been used on large scale yet ? What is the cost of addressing this versus the risk? ARP is a local subnet issue. If someone is already successfully on your LAN you probably have a much bigger problem because they can still do attacks at higher layers of the communications stack. Is this where you want ...


4

When ARP Poisoning You are poisoning the ARP tables. If computer 10.1.1.1 needs to get to computer 10.1.1.2, it keeps the MAC address in its ARP tables. ARP is a trusting protocol, which means when a computer responds to a ARP request, there is nothing requiring its response to be correct and no mechanism for verifying it is correct. So here's the game ...


3

You can't protect a layer-2 network from ARP spoofing. And a single wireless AP consists of a single wireless layer-2 network. I do not know if your wireless AP acts as a bridge (which would propogate the "original" MAC address used by the client wireless card) or a router (which would retransmit using the AP's MAC address). If it's in router mode, then ...


3

Configure your switch to use Private VLANS (PVLANS). PVLANS basically say that physical ports Gi1/1 - 47 can only talk to physical port Gi1/48 (where your gateway is). Even things on the same subnet must go through the gateway to talk. In a setup with N hosts there is generally no reason for the hosts to talk so a PVLAN config is optimal for security. ...


3

Actually, I disagree with tylerl's answer. It is indeed difficult to hide our IP from other hosts on a LAN, it's very possible. Because you're mentioning netcut (a tool that works by using ARP poisoning), I think you have the following setup: You trying to use the Internet. Router giving you access to the Internet. Other hosts on the same LAN. Some ...


3

Suggest you research the latest Cisco APs. I believe these devices are able to isolate each wireless client from each other and from the network. All client traffic is routed instead of switched. You can then setup ACLs to keep WiFi attached clients from reaching anything they should not have access to. Also most enterprise-grade switches support ...


3

Is there a way to encrypt traffic to avoid MITM attacks? Many! Almost every good method for this involves a public/private keypair. To ensure that you are corrected to the correct endpoint, you must know trust the other side's key. If you don't somehow verify the key on the other end of the connection, the value is very limited as an attack can ...


3

According to my research on the subject, and running tests there are no quick fixes for tracking the source individual perpetrating this type of attack because of the nature of it. Meaning tracking, but not filtering/blocking. The attack method itself is basically easy to do compared to the scale of other types of attacks out there due to fundamental flaws ...


2

I have found a solution to this problem. I enabled packet forwarding on my kernel and the attack works great now. sudo sysctl -w net.inet.ip.forwarding=1 Hope this helps anyone in the future.


2

ARP poisoning causes the traffic between those hosts to be forwarded through you, as part of the man in the middle attack. This causes performance degradation on the targets for a few reasons: There is increased latency due to the added network hop. Your network card has to send and receive 2 to 4 times as much data as normal, since you're acting as a ...


2

May be I am wrong, but try to use wireshark Also I think that this might be useful http://compnetworking.about.com/od/networkprotocolsip/f/convertipmacadd.htm


2

Passive-only attack scenarios tend to be rather specialized. Mostly, they involve radio links; the attacker can play with a homemade reception antenna, but is not rich enough to build an emitter which can drown out the genuine signal. This rarely applies to the Internet; this is more relevant to military on-field communications. It could be argued that ...


2

There is a possibility to encrypt the connection to the proxy, there was a question on this site.Please find the link mentioned below.However the methods mentioned may not work at all times. Is it possible to connect to a proxy with an ssl (or otherwise encrypted) connection? To answer your query regarding implementing this on the network infrastructure: ...


2

Regardless of where you are connected, if you are able to do ARP poisoning, that is you let all traffic headed towards the gateway of the network come to you, you will get all traffic and you will be able to intercept it. Q: The router would need to forward the wrong information about its own IP. Doesn't it recognize? In ARP poisoning, you are not ...


2

Sorry, no. As a rule, your IP is visible to anyone on your LAN, which sort of is the definition of what a LAN is.


2

Anyone that can become a man in the middle can perform http manipulation. Check out mitmproxy for an example of how scripts, css, java applets etc can be inserted into an insecure connection. This is possible because http is a plain text protocol and as such can be manipulated by anyone that controls a transit point on any network used to reach your ...


2

The answer to your question seems to lie within the link you have referenced. Computer programs follow specific instructions, and in this case the ettercap filter is set to: replace("img src=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); replace("IMG SRC=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); The character string ...


2

Checking logs. The great secret of dissecting what happened after an attack. Pouring over logs to find the malicious activity and see what it is. If there are no logs, you can't tell. Where to look for the logs is also half the battle because depending on the exact nature of the attack, you could need logs from the client, a server or a router or some ...


2

Possibly due to MAC flooding attack - a kind of Unicast flood attack where an attacker would exhaust space in the MAC allocation table of a switch, so not being able to find the right address in the address cache (all were supplied by the attacker), it would flood the packet out to all ports (if a switch received a unicast packet with a destination address ...


2

The normal usage of ARP is through broadcast frames, because ARP is meant to allow machines to discover the MAC addresses of other hosts: this makes sense only if the MAC address is, indeed, not known beforehand. Normally, a machine is responsible for responding to requests about itself: if someone asks for the MAC address of the machine who currently owns ...


2

Every time a host wants to communicate with another host on a local area network segment it must somehow determine its physical address (this is what a MAC address is, after all). The process of physical address resolution occurs with the ARP protocol. This process consists of an exchange of ethernet frames in order to map logical addresses to physical ...


1

If people who are attacked, put in a static arp entry for the router gateway, they would not be able to be poisoned to goto the attackers machine instead as most of these programs do. It does however require that they do that manually. There is no other way unless you have hardware to help you out.


1

There's an IP collision going on. Although you've convinced 192.168.1.31 that you're 192.168.1.1 with the following command (meaning you've influenced its routing table): sudo arpspoof -i eth0 -t 192.168.1.31 192.168.1.1 ... the 192.168.1.1 still thinks its 192.168.1.1, so when it sees arp requests for its own IP both your machine and the router will ...


1

Some of the solutions I can think of are: If you know the bad guy, catch hold of him and try to know why is (s)he doing this and maybe block him/her. That is one of the best way to stop the attack. Else, If the network is small, you can use static IP addresses and static ARP tables. " arp -s" command will be useful in that case on your linux machine. ...



Only top voted, non community-wiki answers of a minimum length are eligible