- [Announcer] Before we go over what ARP Cache Poisoning
and Route Manipulations attacks are,
let's refresh on what is a Spoofing Attack.
Basically a Spoofing Attack is when
an attacker impersonates another device,
or another IP address, or another person,
to actually execute an attack.
The following are a few examples of Spoofing Attacks.
The first one is an IP address spoofing attack.
And the attacker in this case sends a IP packet
from a fake or a spoofed source address
in order to actually disguise itself.
DDoS attacks typically use spoofing attacks
or IP spoofing attacks to make the packets appear
from legitimate sources and IP addresses,
so, they will avoid being blocked.
Now another type of spoofing attack is ARP spoofing attack.
And in this case, the attacker sends a spoof ARP packet
across a layer 2 network in order to link to the attackers,
or to link the attackers MAC address with the IP address
of a legitimate host.
The best practices that we actually cover later in here,
we will,
will help me actually mitigate our spoofing attacks.
And the other one is actually DNS Server spoofing attacks.
And in this case the actual attacker
modifies the DNS server in only
in order to reroute a specific domain name
to a different IP address.
And DNS server spoofing attacks
are typically used to spread malware.
Now threat actors can attack host, switches
and routers connected to a layer 2 network
by poisoning the ARP cache of systems
connected to the subnet
and by intercepting traffic intended for other host
in the subnet.
Cisco switches support a feature called
Dynamic ARP Inspection,
that validates our packets and intercepts logs
and discards our packets with the invalid IP
to Mac address binding.
Now this feature also protects the network
from certain mine in the middle of attacks
and the dynamic ARP inspection feature safeguard
that only ARP a valid request.
So only valid ARP request and responses are relayed.
They do this by performing a few things.
First, intercepting all ARP request
and responses on untrusted ports.
Then also verifying that each of the intercepted packet
have a valid IP-to-MAC address binding before updating
the local ARP cache, or even before forwarding the packet
to the respective destination host.
They also dropped invalid ARP packets
and determining if an ARP packet is valid based on
the IP-to-MAC address binding stored in a trusted database.
And this database is called
the DHCP snooping binding database.
Now here there are some additional layer 2
security best practices,
for securing your infrastructure against layer 2 attacks.
The first one is actually to select an unused VLAN other
than VLAN 1, and then use that
for the native VLAN for all your trunks.
So don't use VLAN 1 and do not use this native VLAN
for any of your enabled access ports at all.
Right? So, always avoid using VLAN 1 anywhere
because it's actually the default.
Now you can also administratively configure switch ports
as access ports so they,
that the users cannot negotiate a trunk
and then disable the negotiation of trunking.
So, you know basically no Dynamic Trunk Protocol or DTP.
Also, you should limit the number of MAC addresses
learned on a given port with a port security feature.
You can also enable Control Spanning Tree,
to stop users or unknown devices
from manipulating a spanning tree.
And you can do so by using the BPDU Guard
and Root Guard features in those switches.
You should also turn off Cisco Discovery Protocol
on ports that are facing untrusted
or unknown networks that do not require CDP
for anything positive. Right?
So CDP actually operates at layer 2
and may provide attackers with information
that we would rather not disclose,
you know in those ports.
Now on a new switch,
shut down all the ports and assign them to a VLAN
that is not used for anything else.
Then, bring up the ports and assign the correct VLANs
as the ports are actually allocated and needed
you know, in your environment.
Now there are several other layer 2 security features
that can be used to protect your infrastructure,
including Port Security.
And this is actually used to limit the number
of MAC addresses that can be learned
on an access switch port.
Like I mentioned before, BPDU Guard.
So if BPDUs show up where they should not,
then the switch will protect itself.
And other features are Root Guard,
like we mentioned before which actually controls which ports
are not allowed to become root ports or on remote switches.
And then the dynamic ARP inspection
as we actually covered earlier. Right?
IP Source Guard is another one that prevents spoofing
of layer 3 information by hosts.
802.1X to authenticate and authorize users
before you allow them into the network
and to communicate with the rest of the network.
DHCP snooping to prevent rogue DHCP servers
from impacting the network.
Storm Control to limit the amount of broadcast
and multicast traffic flowing through the switch.
And then of course, Access Control list,
both at layer 3 and layer 2,
for traffic control and policy enforcement.
There are different Route Manipulation Attacks up there.
But one of the most common is the BGP hijacking attack.
BGP as you know, is a dynamic routing protocol
that is used to route internet traffic.
And basically, the BGP hijacking attack is launched
by an attacker, by configuring or compromising
an edge router in order to announce prefixes
that have not been assigned to his or her organization.
So if the malicious announcement contains a route
that is more specific at the legitimate advertisement
or even if it presents a shorter path,
then the victim traffic may be redirected to the attacker.
Right? And then of course in all bets are off.
You know this traffic can actually be, you know,
monitor and information can be stolen.
Now in the past threat actors have leveraged unused
prefixes for BGP hijacking in order to avoid attention
from the legitimate users or a specific organization.