1

I've had an error where my mobile hotspot is getting arp requests from a nearby router. The phone was previously owned by the owner of that said router. I've come to notice this by Strange network behavior, I ran wireshark and I had seen that while using mobile data, my gateway get arp requests from the old router.

Does this pose a mitm threat risk going both ways, as in they mitm me or I can mitm them, also what other types of security risks does this pose

Improve this question

1 Answer 1

Reset to default
0

Threat for ARP Spoofing, so in short yes.

Since the ARP protocol is used to find the MAC address of a device corresponding to its IP address, associating the attacker MAC address with the victim's IP (like default gateway) would redirect all traffic supposed to be for the IP to the attacker. That means that data frames can be collected, and so on. Although this is not a MITM yet, it poses as an opening for one, or DOS or session hijacking.

I am a bit confused though, because you're not receiving ARP responses, but requests instead. Usually this kind of attack is conducted by crafting spoofed ARP responses, as the idea is to exploit the lack of authentication in the ARP protocol by sending spoofed ARP messages onto the LAN. In this case the attacker would send an ARP Response to the access point and the victim.

Keep in mind 2 things:

  1. The machines in a network accept ARP Responses even if they haven’t sent an ARP Request.
  2. The machines trust these ARP Responses without any verification.

So, the fact that you're getting requests is a good sign. Was it going to be responses I would have thought you were under an active attack. It would make sense to investigate this more.

How to defend yourself: Static ARP entries or a Software (but it depends which OS you're running)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .