1 1 00:00:00,290 --> 00:00:01,840 Spoofing attacks. 2 2 00:00:01,840 --> 00:00:03,520 In this lesson we're going to discuss 3 3 00:00:03,520 --> 00:00:05,990 some different spoofing attacks that you may come across 4 4 00:00:05,990 --> 00:00:07,500 while working in the field. 5 5 00:00:07,500 --> 00:00:09,800 These attacks include things like IP spoofing, 6 6 00:00:09,800 --> 00:00:11,820 MAC spoofing, ARP spoofing, 7 7 00:00:11,820 --> 00:00:13,270 VLAN hopping. 8 8 00:00:13,270 --> 00:00:15,530 Now, spoofing is a category of network attacks 9 9 00:00:15,530 --> 00:00:18,490 that occurs when an attacker masquerades as another person 10 10 00:00:18,490 --> 00:00:20,350 by falsifying their identity. 11 11 00:00:20,350 --> 00:00:22,510 Just like a person in real life might use a mask 12 12 00:00:22,510 --> 00:00:24,630 to cover their face and hide their true identity, 13 13 00:00:24,630 --> 00:00:26,850 spoofing is the electronic equivalent. 14 14 00:00:26,850 --> 00:00:29,410 Really anything that identifies a user or system 15 15 00:00:29,410 --> 00:00:30,660 can be spoofed. 16 16 00:00:30,660 --> 00:00:33,450 Now, most commonly we're going to see IP spoofing, 17 17 00:00:33,450 --> 00:00:35,500 MAC moving or ARP spoofing used 18 18 00:00:35,500 --> 00:00:37,760 as part of an attack on our networks. 19 19 00:00:37,760 --> 00:00:41,350 IP spoofing occurs when an internet protocol or IP packet 20 20 00:00:41,350 --> 00:00:43,360 is created with a modified source address 21 21 00:00:43,360 --> 00:00:45,570 in order to hide the identity of the sender 22 22 00:00:45,570 --> 00:00:48,110 to impersonate another client or both. 23 23 00:00:48,110 --> 00:00:49,790 When conducting a denial of service attacks 24 24 00:00:49,790 --> 00:00:51,410 such as an ICMP flood, 25 25 00:00:51,410 --> 00:00:54,570 it's common to use IP spoofing as part of the attack. 26 26 00:00:54,570 --> 00:00:56,810 Now, the easiest way to think about IP spoofing 27 27 00:00:56,810 --> 00:00:58,550 is to think about the last time you wrote a letter, 28 28 00:00:58,550 --> 00:00:59,760 and went to mail it. 29 29 00:00:59,760 --> 00:01:01,410 You had to fill out the destination address 30 30 00:01:01,410 --> 00:01:03,130 such as your grandma's name and address, 31 31 00:01:03,130 --> 00:01:05,820 and then you'd fill out the source or from address. 32 32 00:01:05,820 --> 00:01:07,390 This would have the name and address 33 33 00:01:07,390 --> 00:01:08,623 in the upper left-hand corner of the envelope 34 34 00:01:08,623 --> 00:01:10,690 that you were sending it from. 35 35 00:01:10,690 --> 00:01:12,880 Now, if instead of writing your own name and address 36 36 00:01:12,880 --> 00:01:14,290 in the front part of the envelope 37 37 00:01:14,290 --> 00:01:16,400 you decided to write your brother's name and address, 38 38 00:01:16,400 --> 00:01:18,520 then when your grandma receives that letter 39 39 00:01:18,520 --> 00:01:20,910 she initially believes your brother wrote it to her, 40 40 00:01:20,910 --> 00:01:23,480 not you because she saw his name and address 41 41 00:01:23,480 --> 00:01:24,690 in the upper left corner. 42 42 00:01:24,690 --> 00:01:26,010 This is really all there is to it 43 43 00:01:26,010 --> 00:01:27,710 when we talk about IP spoofing. 44 44 00:01:27,710 --> 00:01:29,290 We can just change the from address 45 45 00:01:29,290 --> 00:01:33,400 which we call the source IP inside the TCP/IP protocol. 46 46 00:01:33,400 --> 00:01:36,540 IP spoofing is focused at Layer 3 of the OSI model 47 47 00:01:36,540 --> 00:01:38,870 because we're modifying IP addresses. 48 48 00:01:38,870 --> 00:01:40,350 Now, another version of spoofing 49 49 00:01:40,350 --> 00:01:42,110 involves MAC address spoofing. 50 50 00:01:42,110 --> 00:01:44,620 This is focused at Layer 2 of the OSI model 51 51 00:01:44,620 --> 00:01:46,810 because we're now modifying MAC addresses. 52 52 00:01:46,810 --> 00:01:48,740 Remember each network interface card 53 53 00:01:48,740 --> 00:01:50,900 has a unique MAC address that's assigned to it 54 54 00:01:50,900 --> 00:01:52,260 by the manufacturer. 55 55 00:01:52,260 --> 00:01:54,640 But MAC address spoofing allows an attacker 56 56 00:01:54,640 --> 00:01:56,020 to change their MAC address 57 57 00:01:56,020 --> 00:01:56,900 to pretend they're using 58 58 00:01:56,900 --> 00:01:59,370 a different network interface card or device. 59 59 00:01:59,370 --> 00:02:02,410 Spoofing a MAC address is actually really easy to do. 60 60 00:02:02,410 --> 00:02:04,040 Even though the MAC address is burned 61 61 00:02:04,040 --> 00:02:05,630 into a network interface card, 62 62 00:02:05,630 --> 00:02:08,250 most operating systems allow you to overrate this value 63 63 00:02:08,250 --> 00:02:10,010 inside the operating system. 64 64 00:02:10,010 --> 00:02:11,940 For example, I use a MacBook Pro, 65 65 00:02:11,940 --> 00:02:14,700 and I can change my MAC address of my wireless adapter 66 66 00:02:14,700 --> 00:02:17,440 with a single command line inside the terminal. 67 67 00:02:17,440 --> 00:02:22,220 I simply enter sudo ifconfig en0 ether and a MAC address, 68 68 00:02:22,220 --> 00:02:23,053 and press enter, 69 69 00:02:23,053 --> 00:02:25,350 and all of a sudden my MAC address is changed 70 70 00:02:25,350 --> 00:02:28,160 the MAC address that I specified in that command. 71 71 00:02:28,160 --> 00:02:31,070 Then when I reboot my computer my MacBook Pro 72 72 00:02:31,070 --> 00:02:32,400 will reset my MAC address 73 73 00:02:32,400 --> 00:02:34,770 back to the one that's burned into the wireless adapter 74 74 00:02:34,770 --> 00:02:36,060 by the manufacturer. 75 75 00:02:36,060 --> 00:02:38,440 So it's just a temporary change I can do. 76 76 00:02:38,440 --> 00:02:41,130 Often networks will use network access controls 77 77 00:02:41,130 --> 00:02:43,600 to allow only authorized people to connect to the network. 78 78 00:02:43,600 --> 00:02:46,610 And the simplest form of this is to use MAC filtering 79 79 00:02:46,610 --> 00:02:48,300 which relies on a list of all the known, 80 80 00:02:48,300 --> 00:02:49,900 and authorized MAC addresses. 81 81 00:02:49,900 --> 00:02:53,280 So as an attacker I can simply spoof the MAC address 82 82 00:02:53,280 --> 00:02:55,270 of somebody who is authorized to join the network, 83 83 00:02:55,270 --> 00:02:57,670 and now I can bypass your MAC filtering, 84 84 00:02:57,670 --> 00:02:59,390 and join the network as if I was somebody 85 85 00:02:59,390 --> 00:03:00,540 who was authorized. 86 86 00:03:00,540 --> 00:03:02,070 Now, there's a third type of spoofing 87 87 00:03:02,070 --> 00:03:04,160 that you may experience inside your networks, 88 88 00:03:04,160 --> 00:03:06,260 and this is known as ARP spoofing. 89 89 00:03:06,260 --> 00:03:08,100 ARP spoofing occurs when the attacker sends 90 90 00:03:08,100 --> 00:03:11,020 falsified ARP messages over a local area network. 91 91 00:03:11,020 --> 00:03:12,520 Remember, the purpose of ARP, 92 92 00:03:12,520 --> 00:03:14,290 or the Address Resolution Protocol 93 93 00:03:14,290 --> 00:03:15,420 is to create a binding between 94 94 00:03:15,420 --> 00:03:17,300 an IP address and a MAC address 95 95 00:03:17,300 --> 00:03:19,180 inside the local area network. 96 96 00:03:19,180 --> 00:03:21,350 As the information travels from computer to computer 97 97 00:03:21,350 --> 00:03:22,480 across the internet, 98 98 00:03:22,480 --> 00:03:24,280 it's going to rely on the IP addresses 99 99 00:03:24,280 --> 00:03:26,100 to transfer packets from router to router 100 100 00:03:26,100 --> 00:03:27,250 across the internet. 101 101 00:03:27,250 --> 00:03:29,970 But once it finds the right local area network 102 102 00:03:29,970 --> 00:03:32,660 that IP address at Layer 3 has to be converted 103 103 00:03:32,660 --> 00:03:35,470 to the MAC address of that device at Layer 2 104 104 00:03:35,470 --> 00:03:37,840 so it can be delivered to the final destination client 105 105 00:03:37,840 --> 00:03:39,110 using your switch. 106 106 00:03:39,110 --> 00:03:40,980 This occurs by using an ARP table 107 107 00:03:40,980 --> 00:03:43,010 which is maintained by the routers and the switches 108 108 00:03:43,010 --> 00:03:44,050 on your network. 109 109 00:03:44,050 --> 00:03:45,210 If an attacker wants to pretend 110 110 00:03:45,210 --> 00:03:46,680 to be a different client on the network 111 111 00:03:46,680 --> 00:03:48,170 in order to intercept those frames 112 112 00:03:48,170 --> 00:03:49,690 destined for a different client, 113 113 00:03:49,690 --> 00:03:50,880 they can go ahead and change 114 114 00:03:50,880 --> 00:03:53,020 the IP address and MCA address binding 115 115 00:03:53,020 --> 00:03:54,730 that's stored inside this ARP table 116 116 00:03:54,730 --> 00:03:56,370 by doing ARP spoofing. 117 117 00:03:56,370 --> 00:03:58,330 To do that they would send out an ARP message, 118 118 00:03:58,330 --> 00:04:00,820 and advertise their IP address as the correct one 119 119 00:04:00,820 --> 00:04:03,290 for the MAC address of the victimized client. 120 120 00:04:03,290 --> 00:04:05,770 So this ARP spoofing attack can be used 121 121 00:04:05,770 --> 00:04:07,600 as a precursor to other attacks. 122 122 00:04:07,600 --> 00:04:10,220 Things like interception or modification of frames 123 123 00:04:10,220 --> 00:04:12,450 using an on-path or man-in-the-middle attack 124 124 00:04:12,450 --> 00:04:14,540 at Layer 2 of the OSI model. 125 125 00:04:14,540 --> 00:04:15,810 To prevent ARP poisoning 126 126 00:04:15,810 --> 00:04:17,730 you should set up good VLAN segmentation 127 127 00:04:17,730 --> 00:04:19,210 within your network. 128 128 00:04:19,210 --> 00:04:21,690 Our next attack is known as VLAN hopping. 129 129 00:04:21,690 --> 00:04:23,740 Now VLAN hopping occurs when an attacker 130 130 00:04:23,740 --> 00:04:25,070 is able to send traffic 131 131 00:04:25,070 --> 00:04:27,700 from one VLAN into another effectively 132 132 00:04:27,700 --> 00:04:29,690 bypassing the VLAN segmentation 133 133 00:04:29,690 --> 00:04:32,140 that you've configured within your Layer 2 networks. 134 134 00:04:32,140 --> 00:04:34,940 VLAN hopping can be accomplished using one of two methods. 135 135 00:04:34,940 --> 00:04:38,070 You can either use double tagging or switch spoofing. 136 136 00:04:38,070 --> 00:04:39,810 Double tagging occurs when an attacker 137 137 00:04:39,810 --> 00:04:41,920 is connected to an interface on the switch 138 138 00:04:41,920 --> 00:04:44,350 using access mode with the same VLAN 139 139 00:04:44,350 --> 00:04:47,240 as the native untagged VLAN on that trunk. 140 140 00:04:47,240 --> 00:04:49,880 Then whenever the attacker sends a frame on the network 141 141 00:04:49,880 --> 00:04:53,290 they're going to send it with two 802.1Q tags. 142 142 00:04:53,290 --> 00:04:55,130 This is why we call it double tagging. 143 143 00:04:55,130 --> 00:04:57,260 The inner tag will contain the true destination 144 144 00:04:57,260 --> 00:04:58,660 the attacker is trying to reach. 145 145 00:04:58,660 --> 00:05:01,350 The outer tag will contain the native VLAN 146 146 00:05:01,350 --> 00:05:04,150 Remember the native VLAN is the one VLAN we have 147 147 00:05:04,150 --> 00:05:06,340 the normally travels across the trunk port 148 148 00:05:06,340 --> 00:05:07,920 without a VLAN tag. 149 149 00:05:07,920 --> 00:05:10,700 So when the switch receives this double tagged frame 150 150 00:05:10,700 --> 00:05:12,570 it first removes the outer tag 151 151 00:05:12,570 --> 00:05:14,200 that contains the native VLAN, 152 152 00:05:14,200 --> 00:05:16,390 and then it forwards the frame to the VLAN 153 153 00:05:16,390 --> 00:05:17,690 of the second tag 154 154 00:05:17,690 --> 00:05:19,570 which was the inner tag with the location 155 155 00:05:19,570 --> 00:05:21,660 the attacker is trying to really get to. 156 156 00:05:21,660 --> 00:05:23,090 The result here is that the attacker 157 157 00:05:23,090 --> 00:05:25,000 is able to break out of their own VLAN 158 158 00:05:25,000 --> 00:05:26,800 in this case the native VLAN, 159 159 00:05:26,800 --> 00:05:29,300 and migrate into the destination VLAN. 160 160 00:05:29,300 --> 00:05:31,140 It's also important to note that this technique 161 161 00:05:31,140 --> 00:05:33,430 is really a one-way trip for those frames though, 162 162 00:05:33,430 --> 00:05:36,210 because the destination wouldn't double tag the data, 163 163 00:05:36,210 --> 00:05:37,680 and send it back to them. 164 164 00:05:37,680 --> 00:05:40,570 So, why would an attacker use double-tagging 165 165 00:05:40,570 --> 00:05:42,080 to send out into a VLAN 166 166 00:05:42,080 --> 00:05:44,480 without being able to receive any response back? 167 167 00:05:44,480 --> 00:05:46,600 Well, usually this is part of a technique 168 168 00:05:46,600 --> 00:05:48,630 that's going to be part of a denial of service attack 169 169 00:05:48,630 --> 00:05:50,300 since you wouldn't need to receive a response 170 170 00:05:50,300 --> 00:05:52,520 for any data being forwarded into this VLAN 171 171 00:05:52,520 --> 00:05:53,630 using double tagging, 172 172 00:05:53,630 --> 00:05:56,100 and instead you just want to send a bunch of data in. 173 173 00:05:56,100 --> 00:05:58,350 Now, the second method of performing VLAN hopping 174 174 00:05:58,350 --> 00:06:00,090 is known as switch spoofing. 175 175 00:06:00,090 --> 00:06:02,740 Switch spoofing occurs when an attacker attempts to conduct 176 176 00:06:02,740 --> 00:06:06,260 a Dynamic Trunking Protocol or DTP negotiation. 177 177 00:06:06,260 --> 00:06:07,940 This is normally performed by a switch 178 178 00:06:07,940 --> 00:06:09,740 when it's connected to a trunk port. 179 179 00:06:09,740 --> 00:06:11,820 By default trunk ports are set up to support 180 180 00:06:11,820 --> 00:06:14,040 auto-negotiation between two switches 181 181 00:06:14,040 --> 00:06:16,060 so they can share VLAN information. 182 182 00:06:16,060 --> 00:06:18,560 So if an attacker configures their attack workstation 183 183 00:06:18,560 --> 00:06:19,700 to act like a switch, 184 184 00:06:19,700 --> 00:06:21,290 and it sets it to dynamic auto, 185 185 00:06:21,290 --> 00:06:23,430 or dynamic desirable switch port mode, 186 186 00:06:23,430 --> 00:06:26,030 when the attack workstation is connected to a trunk port 187 187 00:06:26,030 --> 00:06:28,220 it will automatically try to negotiate 188 188 00:06:28,220 --> 00:06:30,890 a trunking connection just like a switch would. 189 189 00:06:30,890 --> 00:06:32,560 Now, once that trunk is established 190 190 00:06:32,560 --> 00:06:34,770 with the attackers workstation by the switch, 191 191 00:06:34,770 --> 00:06:37,060 the workstation will now have access to all the VLANs 192 192 00:06:37,060 --> 00:06:38,520 inside the network. 193 193 00:06:38,520 --> 00:06:39,810 To prevent this from occurring 194 194 00:06:39,810 --> 00:06:41,720 you should always configure your switch ports 195 195 00:06:41,720 --> 00:06:44,060 to have dynamic switch port modes disabled. 196 196 00:06:44,060 --> 00:06:47,150 After all, if your switch doesn't support auto-negotiation 197 197 00:06:47,150 --> 00:06:48,660 because you're disabled this mode, 198 198 00:06:48,660 --> 00:06:50,030 you can prevent this type of attack 199 199 00:06:50,030 --> 00:06:52,580 from occurring on your networks in the first place.