-: Spoofing attacks. 2 2
In this lesson we're going to discuss 3 3
some different spoofing attacks that you may come across 4 4
while working in the field. 5 5
These attacks include things like IP spoofing, 6 6
MAC spoofing, ARP spoofing, 7 7
VLAN hopping. 8 8
Now, spoofing is a category of network attacks 9 9
that occurs when an attacker masquerades as another person 10 10
by falsifying their identity. 11 11
Just like a person in real life might use a mask 12 12
to cover their face and hide their true identity, 13 13
spoofing is the electronic equivalent. 14 14
Really anything that identifies a user or system 15 15
can be spoofed. 16 16
Now, most commonly we're going to see IP spoofing, 17 17
MAC moving or ARP spoofing used 18 18
as part of an attack on our networks. 19 19
IP spoofing occurs when an internet protocol or IP packet 20 20
is created with a modified source address 21 21
in order to hide the identity of the sender 22 22
to impersonate another client or both. 23 23
When conducting a denial of service attacks 24 24
such as an ICMP flood, 25 25
it's common to use IP spoofing as part of the attack. 26 26
Now, the easiest way to think about IP spoofing 27 27
is to think about the last time you wrote a letter, 28 28
and went to mail it. 29 29
You had to fill out the destination address 30 30
such as your grandma's name and address, 31 31
and then you'd fill out the source or from address. 32 32
This would have the name and address 33 33
in the upper left-hand corner of the envelope 34 34
that you were sending it from. 35 35
Now, if instead of writing your own name and address 36 36
in the front part of the envelope 37 37
you decided to write your brother's name and address, 38 38
then when your grandma receives that letter 39 39
she initially believes your brother wrote it to her, 40 40
not you because she saw his name and address 41 41
in the upper left corner. 42 42
This is really all there is to it 43 43
when we talk about IP spoofing. 44 44
We can just change the from address 45 45
which we call the source IP inside the TCP/IP protocol. 46 46
IP spoofing is focused at Layer 3 of the OSI model 47 47
because we're modifying IP addresses. 48 48
Now, another version of spoofing 49 49
involves MAC address spoofing. 50 50
This is focused at Layer 2 of the OSI model 51 51
because we're now modifying MAC addresses. 52 52
Remember each network interface card 53 53
has a unique MAC address that's assigned to it 54 54
by the manufacturer. 55 55
But MAC address spoofing allows an attacker 56 56
to change their MAC address 57 57
to pretend they're using 58 58
a different network interface card or device. 59 59
Spoofing a MAC address is actually really easy to do. 60 60
Even though the MAC address is burned 61 61
into a network interface card, 62 62
most operating systems allow you to overrate this value 63 63
inside the operating system. 64 64
For example, I use a MacBook Pro, 65 65
and I can change my MAC address of my wireless adapter 66 66
with a single command line inside the terminal. 67 67
I simply enter sudo ifconfig en0 ether and a MAC address, 68 68
and press enter, 69 69
and all of a sudden my MAC address is changed 70 70
the MAC address that I specified in that command. 71 71
Then when I reboot my computer my MacBook Pro 72 72
will reset my MAC address 73 73
back to the one that's burned into the wireless adapter 74 74
by the manufacturer. 75 75
So it's just a temporary change I can do. 76 76
Often networks will use network access controls 77 77
to allow only authorized people to connect to the network. 78 78
And the simplest form of this is to use MAC filtering 79 79
which relies on a list of all the known, 80 80
and authorized MAC addresses. 81 81
So as an attacker I can simply spoof the MAC address 82 82
of somebody who is authorized to join the network, 83 83
and now I can bypass your MAC filtering, 84 84
and join the network as if I was somebody 85 85
who was authorized. 86 86
Now, there's a third type of spoofing 87 87
that you may experience inside your networks, 88 88
and this is known as ARP spoofing. 89 89
ARP spoofing occurs when the attacker sends 90 90
falsified ARP messages over a local area network. 91 91
Remember, the purpose of ARP, 92 92
or the Address Resolution Protocol 93 93
is to create a binding between 94 94
an IP address and a MAC address 95 95
inside the local area network. 96 96
As the information travels from computer to computer 97 97
across the internet, 98 98
it's going to rely on the IP addresses 99 99
to transfer packets from router to router 100 100
across the internet. 101 101
But once it finds the right local area network 102 102
that IP address at Layer 3 has to be converted 103 103
to the MAC address of that device at Layer 2 104 104
so it can be delivered to the final destination client 105 105
using your switch. 106 106
This occurs by using an ARP table 107 107
which is maintained by the routers and the switches 108 108
on your network. 109 109
If an attacker wants to pretend 110 110
to be a different client on the network 111 111
in order to intercept those frames 112 112
destined for a different client, 113 113
they can go ahead and change 114 114
the IP address and MCA address binding 115 115
that's stored inside this ARP table 116 116
by doing ARP spoofing. 117 117
To do that they would send out an ARP message, 118 118
and advertise their IP address as the correct one 119 119
for the MAC address of the victimized client. 120 120
So this ARP spoofing attack can be used 121 121
as a precursor to other attacks. 122 122
Things like interception or modification of frames 123 123
using an on-path or man-in-the-middle attack 124 124
at Layer 2 of the OSI model. 125 125
To prevent ARP poisoning 126 126
you should set up good VLAN segmentation 127 127
within your network. 128 128
Our next attack is known as VLAN hopping. 129 129
Now VLAN hopping occurs when an attacker 130 130
is able to send traffic 131 131
from one VLAN into another effectively 132 132
bypassing the VLAN segmentation 133 133
that you've configured within your Layer 2 networks. 134 134
VLAN hopping can be accomplished using one of two methods. 135 135
You can either use double tagging or switch spoofing. 136 136
Double tagging occurs when an attacker 137 137
is connected to an interface on the switch 138 138
using access mode with the same VLAN 139 139
as the native untagged VLAN on that trunk. 140 140
Then whenever the attacker sends a frame on the network 141 141
they're going to send it with two 802.1Q tags. 142 142
This is why we call it double tagging. 143 143
The inner tag will contain the true destination 144 144
the attacker is trying to reach. 145 145
The outer tag will contain the native VLAN 146 146
Remember the native VLAN is the one VLAN we have 147 147
the normally travels across the trunk port 148 148
without a VLAN tag. 149 149
So when the switch receives this double tagged frame 150 150
it first removes the outer tag 151 151
that contains the native VLAN, 152 152
and then it forwards the frame to the VLAN 153 153
of the second tag 154 154
which was the inner tag with the location 155 155
the attacker is trying to really get to. 156 156
The result here is that the attacker 157 157
is able to break out of their own VLAN 158 158
in this case the native VLAN, 159 159
and migrate into the destination VLAN. 160 160
It's also important to note that this technique 161 161
is really a one-way trip for those frames though, 162 162
because the destination wouldn't double tag the data, 163 163
and send it back to them. 164 164
So, why would an attacker use double-tagging 165 165
to send out into a VLAN 166 166
without being able to receive any response back? 167 167
Well, usually this is part of a technique 168 168
that's going to be part of a denial of service attack 169 169
since you wouldn't need to receive a response 170 170
for any data being forwarded into this VLAN 171 171
using double tagging, 172 172
and instead you just want to send a bunch of data in. 173 173
Now, the second method of performing VLAN hopping 174 174
is known as switch spoofing. 175 175
Switch spoofing occurs when an attacker attempts to conduct 176 176
a Dynamic Trunking Protocol or DTP negotiation. 177 177
This is normally performed by a switch 178 178
when it's connected to a trunk port. 179 179
By default trunk ports are set up to support 180 180
auto-negotiation between two switches 181 181
so they can share VLAN information. 182 182
So if an attacker configures their attack workstation 183 183
to act like a switch, 184 184
and it sets it to dynamic auto, 185 185
or dynamic desirable switch port mode, 186 186
when the attack workstation is connected to a trunk port 187 187
it will automatically try to negotiate 188 188
a trunking connection just like a switch would. 189 189
Now, once that trunk is established 190 190
with the attackers workstation by the switch, 191 191
the workstation will now have access to all the VLANs 192 192
inside the network. 193 193
To prevent this from occurring 194 194
you should always configure your switch ports 195 195
to have dynamic switch port modes disabled. 196 196
After all, if your switch doesn't support auto-negotiation 197 197
because you're disabled this mode, 198 198
you can prevent this type of attack 199 199
from occurring on your networks in the first place.