CSE363 Offensive Security Network Traffic Interception 2020-02-05 Michalis Polychronakis Stony Brook University Active vs. Passive Attacks Passive: the attacker eavesdrops but does not modify the message stream in any way Traffic snooping, wiretapping, passive reconnaissance, listening for unsolicited/broadcast traffic, traffic analysis, … Previous lecture Active: the attacker may transmit messages, replay old messages, modify messages in transit, or drop selected messages from the wire Spoofing, data injection/manipulation (man-in-the-middle/man-on-the-side), session replay, DoS, malicious requests/resp., … This lecture 2 Link Layer Attacks Spoofing Impersonate another machine Bypass address-based authentication Change MAC address to get 30’ more of free WiFi Hide the device’s vendor (first three bytes of MAC address) Denial of Service (DoS) Flooding WiFi deauth Traffic injection or interception Man on the Side (MotS) Man in the Middle (MitM) 3 Address Resolution Protocol (ARP) Allows mapping of IP addresses to physical addresses A new machine joins a LAN; How can it find the MAC addresses of a neighbor machine? ARP request (broadcast): Who has IP 192.168.0.1? ARP reply by 192.168.0.1: Hey, here I am, this is my MAC address Each host maintains a local ARP cache Send request only if local table lookup fails ARP announcements (gratuitous ARP) Voluntarily announce address updates (NIC change, load balancing/failover, …) Can be abused… 4 ARP Cache Poisoning ARP replies can be spoofed: IP to MAC mapping is not authenticated! Enables traffic sniffing/manipulation through MitM Normal Operation switch gateway Internet ARP Cache Poisoning Internet 5 ARP Cache Poisoning Attack steps 1. ARP reply to victim, mapping gateway’s IP to attacker’s MAC 2. ARP reply to gateway, mapping victim’s IP to attacker’s MAC 3. Just forward packets back and forth Internet 1 2 3 6 ARP Cache Poisoning Tools arpspoof (dsniff) Ettercap -> Bettercap nemesis … Various Defenses Static ARP entries: ignore ARP reply packets OS configuration: ignore unsolicited replies, … ARPwatch and other detection tools Managed switches 7 CAM Table Exhaustion Switches use Content Addressable Memory (CAM) to keep MAC address to port mappings Finite resource! Flooding a switch with a large number of randomly generated MAC addresses can fill up the CAM table Failsafe operation: send all packets to all ports Essentially the switch turns into a hub  eavesdropping! Noisy attack, can be easily detected Tool: macof (part of dsniff) 8 Rogue Access Points No authentication of the AP to the client Set up fake AP with an existing SSID or an enticing name (e.g., Starbucks-FREE-WiFi) “Auto-connect”/”Ask to join network” mobile phone features greatly facilitate this kind of attacks Pineapple, Power Pwn, … Wireless backdoor Ship an iPhone/special purpose device to an office and use 4G/LTE/5G connection for C&C Hide a tiny AP in a wall plug etc. Detection NetStumbler: show all WiFi networks RF monitoring systems Wireless IDS/IPS 9 WiFi-Pumpkin https://github.com/P0cL4bs/WiFi-Pumpkin 10