3

My Current Background on the topic

DHCP Spoofing is done by a rogue DHCP server on the network which replies to DHCP requests from hosts(Attacker can run a DHCP starvation attack on the legitimate DHCP server to stop it from handing away IP addresses). The rogue server can spoof the gateway & DNS servers therefor all DNS & Traffic going away from local subnet will start to flow to the attacker. The attacker then forward the received traffic accordingly so the hosts won’t notice any disruption in connectivity and effectively pulling off a MITM attack.

In ARP Poisoning, attacker send spoofed arp messages to the network and arp cache of the switch will have wrong information so the switch starts to send traffic to the attacker (which should originally go to another host or default gateway)

DHCPDISCOVER, DHCPOFFER, DHCPREQUEST & DHCPACK are broadcast messages so typically all hosts in the local subnet will receive all this messages anyway. Even if the attacker has already done some ARP poisoning on the local subnet it won’t affect the process of DHCP.

ARP is used for resolving Internet layer addresses into link layer addresses.Since ahost does not have an IP address until DHCP process is completed ARP attacks seems useless on DHCP

My Question As per my understanding These two attacks are two different ways that can be used to achieve same results. But I need to clarify this without any doubt.

Is there any way you can pull off a DHCP Spoofing attack by using ARP poisoning?

  • ARP poison can lie to the victim that you are the DHCP server. – defalt Nov 2 '17 at 5:20
  • @defalt Could you please explain a little bit in detail – RanjanaLK Nov 2 '17 at 6:38
  • 1
    @RanjanaLK If you know how ARP poisoning works and if you know how DHCP spoofing works, then that's pretty much it. :) – Tom K. Nov 2 '17 at 10:44
5

I just happen to be writing a series of articles covering such network attacks from a practical point-of-view. Here is the article on DHCP, ARP will follow.

DHCP and ARP are indeed two different attacks allowing the attacker to achieve a MITM within a subnet.

DHCP Spoofing is done by a rogue DHCP server on the network which replies to DHCP requests from hosts(Attacker can run a DHCP starvation attack on the legitimate DHCP server to stop it from handing away IP addresses). The rogue server can spoof the gateway & DNS servers therefor all DNS & Traffic going away from local subnet will start to flow to the attacker. The attacker then forward the received traffic accordingly so the hosts won’t notice any disruption in connectivity and effectively pulling off a MITM attack.

This is right.

In ARP Poisoning, attacker send spoofed arp messages to the network and arp cache of the switch will have wrong information so the switch starts to send traffic to the attacker (which should originally go to another host or default gateway)

The classical ARP attack doesn't target the switches but end-devices.

Each devices given an IP, need to obtain the corresponding MAC address to establish a communication. This is what the ARP is for.

The attack consists in forcing a device into resolving an IP as the attacker's MAC address instead of the legitimate one.

Nevertheless, there is also a less common attack targeting the switch, making it believe that a certain MAC address can be reached through the attacker's port instead of the legitimate one. This attack is less convenient and reserved for situations where the previous one doesn't work (MAC address hardcoded in devices configuration for instance).

DHCPDISCOVER, DHCPOFFER, DHCPREQUEST & DHCPACK are broadcast messages

DHCPDISCOVER and DHCPREQUEST are indeed broadcasted, the two other usually aren't.

so typically all hosts in the local subnet will receive all this messages anyway. Even if the attacker has already done some ARP poisoning on the local subnet it won’t affect the process of DHCP.

It depends the degree of chaos the attacker has already spread in the network ;) , but fundamentally you're right: ARP is not related to DHCP here.

ARP is used for resolving Internet layer addresses into link layer addresses.Since ahost does not have an IP address until DHCP process is completed ARP attacks seems useless on DHCP

I think of two cases where ARP-based attacks may be a good complement to DHCP-based attacks:

  1. DHCP client messages are usually only broadcasted during the initial network configuration, when a network device is brought up (or when the legitimate DHCP server doesn't reply... DOS?). When a device needs to renew a DHCP lease, the DHCP REQUEST message usually isn't broadcasted anymore but is only a unicast message sent to the DHCP server which initially offered the lease.

    DHCP MITM attacks are therefore usually only possible during the boot process of a device or when a running device is joining to the network.

    Using ARP would allow to impersonate the DHCP server and intercept the client's DHCP REQUEST message. This may be for instance a way to push a new default router IP to a device where the MAC address of the legitimate router has been hardcoded, but its IP hasn't.

  2. More fun: the case of DHCP DOS attacks. Check the DHCPig tool, it is a DOS tool implementing a DHCP starvation attack: the attacker leases all available IP addresses from the DHCP server so that no new address will be available for the other devices.

    The core of this attack is basic and only rely on DHCP messages, but DHCPig adds a few features I like, and which involve ARP messages:

    • Using an ARP scan, DHCPig detects the other currently running devices and their IP and then sends a DHCP RELEASE message to the DHCP server, therefore marking their IP as free so they can now be stolen by the attacker.

    • Once the DHCP server has been DOSed-out, DHCPig can broadcast ARP messages which will simulate an IP conflict for each IP address composing the subnet. For Unix-like systems, this won't do much, but when Windows systems detect such conflict they immediately drop their current IP address and request a new one to the DHCP server... which is unable to fulfill the request, leaving the Windows client unconfigured. In other words, the ARP packets allowed to kick the Windows devices out of the network.

3

Because ARP has no authentication or verification on it, you can set up a rogue DHCP server, send out bogus ARP packets telling servers that you are the DHCP server, then hand out DHCP reservations that suit your needs. With DHCP and ARP poisoning you can do things such as allowing your computer to connect via SSH to a host, despite the host having a firewall blocking SSH from everything except one computer normally, for example.

For contrast -

A DHCP only attack could be compromising a DHCP server and then using it to give a sensitive IP to your malicious device, as above - no ARP poisoning needed!

An ARP only attack would involve you poisoning an ARP cache so the device routes traffic to your malicious device so you can MITM or traffic sniff it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.