2

What attacks can a subnet gateway perform on the subnet?

For example, my ip4 address is 192.168.116.34 and the gateway is 192.168.116.111.

What are the threats I am exposed to from a person sitting on 192.168.116.111 or if someone has changed his ipv4 to 192.168.116.111?

1

This is a tough question, as the answer to this question in a corporate environment will most likely be different than in a home environment.

An attacker having access to the same vlan/subnet you are on is usually very dangerous. Ignoring that the computer can try lots of tricks that only work with local access (arp attacks on the switch, computer spoofing, bruteforcing behind the firewall) I'd say you're most vulnerable to MiTM and DNS attacks.

For DNS: typically the home router defaults as the DNS forwarder to the ISP's recursive resolvers. If you now own the DNS, you can create fake websites and point people at them. Fake Banking site for example, and steal your bank creds. Always look for the Https symbol in your browser.

MiTM can be done by creating a route on the gateway to another device that will act as a proxy, and effectively as a MiTM host. Then traffic can be SSL stripped, exploits used against it that are only possible in this situation, etc.

Having your gateway get "owned" is very dangerous.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.