Address Resolution Protocol (ARP) spoofing or ARP
poisoning is a form of spoofing attack that hackers use to
intercept data. A hacker commits an ARP spoofing attack by tricking
one device into sending messages to the hacker instead of the
intended recipient. This way, the hacker gains access to your
device’s communications, including sensitive data such as
passwords and credit card information. Luckily, you can protect
yourself against these attacks in several ways.
The ARP Protocol and ARP Spoofing
ARP spoofing occurs on a local area network (LAN) using an ARP.
An ARP is a communication protocol connecting a dynamic internet
protocol (IP) address to a physical machine address. The latter is
referred to as a media access control (MAC) address. The ARP
protocol directs the communication on the LAN.
Each network device has both an IP address and a MAC address.
To send and receive messages, hosts on a network must know the
addresses of the others on that network. In doing so, a host will
connect a (typically dynamic IP address to a physical MAC
address).
For example, Host A on a computer network wants to connect its IP
address to the MAC address of Host B. Therefore, it sends an ARP
request to all the other hosts on the LAN. Following this request, it
receives an ARP response from Host B, with its MAC address. The
requesting host then stores this address on its ARP cache, which is
similar to a contacts list. This cache is sometimes referred to as an
ARP table, as the addresses are stored in the form of a table.
ARP spoofing refers to an attacker with access to the LAN
pretending to be Host B. The attacker sends messages to Host A
with the goal of tricking Host A into saving the attacker’s address as
Host B’s address. Host A will ultimately send communications
intended for Host B to the attacker instead. Once the attacker
becomes this middle man, each time Host A communicates with
Host B, that host will in fact be communicating first with the
attacker. Host B will typically be the default gateway, or the router.
Purpose of an ARP Spoof Attack
An ARP spoof attack can have several goals. Attackers can use
ARP spoofing for spying, man-in-the-middle attacks or for additional
cyberattacks, such as denial-of-service attacks.
What Are Spying and Denial-of-Service Attacks?
Spying happens when the attacker does not modify the
communications between Hosts A and B but only reads the
communications and then forwards them to the intended host. With
a man-in-the-middle attack, the attacker modifies the information
before sending it on to the intended host.
However, these acts of spying and modifying messages are often a
part of a more elaborate cyberattack involving lateral
movement. One is a denial-of-service attack, in which the
attacker prevents communications from being sent between two or
more hosts. Attackers may also send malicious files between hosts.
Who Uses ARP Spoofing?
Hackers have used ARP spoofing since the 1980s. Attacks by
hackers can be planned or opportunistic. Planned attacks include
denial-of-service attacks, whereas stealing information from a public
WI-FI network would be an example of opportunism. Although these
attacks are preventable, they are still frequently used because they
are easy to conduct from both financial and technical points of view.
However, ARP spoofing can also be done for worthy purposes.
Developers also use ARP spoofing to debug network traffic by
purposely inserting a middle man between two hosts. Ethical
hackers will also simulate ARP cache poisoning attacks to ensure
networks are safe from such attacks.
Effects of ARP Spoofing
ARP spoofing has similar effects to other forms of spoofing, such
as email spoofing . Noticeable effects of ARP spoofing can range
from none to a full loss of connection to the network if the attacker
implements a denial-of-service attack. Whether the effects of the
attack are seen depends on the goals of the hacker. If they are only
looking to spy on or modify information between hosts, they may
well go unnoticed. If they are looking to instigate a further attack, as
is often the case with ARP spoofing attacks, they will also want to
remain unnoticed. However, such attacks will become obvious once
their end goal is reached. For instance, your system may be
overloaded by malware communications or your machine could be
infected with ransomware.
Why ARP Spoofing Is Dangerous
