CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.4  Attacks

How Can We Protect Our Network From Spoofing? 1 2 1.4.5  Replay

The Man In The Middle attack, or MITM for short, is another attack made possible by lax security in the IP protocol. As we already know, a normal TCP/IP conversation takes place between 2 hosts, and involves the sending, receiving and acknowledgment of packets. An MITM attack can be compared to inserting a black box in between the 2 hosts participating in the conversation.

If an attacker can place himself in a position where he is on the network between the two hosts, it is technically possible for the attacker to control what data is sent between the hosts. The attacker’s machine does not have to be physically between the two hosts… the other two machines just have to be convinced to route packets destined for the other host through the attacker’s machine.

Going back to the Freedom and Spirit example above, assume now that Freedom and Spirit communicate with each other, but instead of using a trusted internal network, they exchange information across a public network. How does the attacker ensure that all packets sent between the two hosts pass through their machine?

One way to do it would be for the attacker to set up a machine with two network cards, then send out fake ARP requests to force packet routing between those two hosts to go via his machine.

(Remember that ARP is used to link IP addresses to MAC addresses; the attacker can take advantage of the fact that nothing prevents someone from introducing ARP packets that contain misleading information.) Once the attacker gets the packets routed through his machine, he then takes the incoming packets from Freedom, decodes them and checks the contents. If he sees something he wants, for example a bank transaction he would like to divert, he can rewrite the data in the packet, and send it off to Spirit. By the same token, when packets come in from Spirit destined for Freedom, he can change the contents of those. He can also pass packets through unchanged, if he wishes.

The effect is somewhat like the spoofing example presented above, however, this is far harder to detect. While the spoofing attack relies on sending brand new packets to a host, the MITM attack is actually changing data sent between hosts on the fly. Therefore, should you ever audit the data to find out why the bank transactions seem to have gone awry, you’ll see that data was sent by Freedom and received by Spirit in the correct order, it just “got changed somehow”.

In addition, because the MITM attack manipulates packets already created and sent, you are removing the “luck” factor from a spoofing attack. For example, if you have correctly set up the MITM attack you can be assured, that provided you stay within the parameters of the data, any information you change will be readily acceptable by the destination host. However with a spoof attack, you are effectively working blind, as there is no guarantee that the target host will accept your data.

How Can We Protect Our Network From Spoofing? 1 2 1.4.5  Replay