6 How can a computer use ARP to break security?

Answer 1

But if the gateway computer's knowledge of the destination computer's MAC address is either missing or too old and expired, it must send a broadcast to all of the computers on the LAN network asking which specific computer is assigned to the IP address of the packet the gateway is trying to forward. To do this the gateway broadcasts an ARP Request that will be received by every computer on the Ethernet LAN. The request simply asks for a reply from the one machine that is currently assigned to the IP contained in the request. Each computer on the LAN checks to see whether the IP is (one of) its own. The computer finding a match with (one of) its own IPs will send an ARP Reply back to the requesting device. When the gateway computer receives the ARP Reply, it has the MAC address of the replying computer along with the replying computer's IP address, contained in the reply packet. The receiving machine enters this information into a "cache" of all similar IP-address-to-MAC-address pairings which is maintained for every machine it has communicated with on the LAN. This is known as the machine's "ARP Cache" since it retains the history of all previous unexpired ARP Replies which it has received. Every computer participating on the LAN maintains its own similar ARP cache containing the IP-to-MAC relationships that allow them to properly address IP packets with Ethernet MAC addresses.

Notice that in this example, our gateway computer added this new entry into its ARP cache upon the receipt of an ARP Reply packet. The ARP protocol is so simple - just asking who has the IP and replying "I have the IP" - that there is no provision for any sort of security or authentication of the replying computer. In other words, any computer on the LAN could claim to have the IP in question. The implementation of the ARP protocol is so simple and straightforward that the receipt of an ARP reply at any time, even when there are no ARP requests outstanding, causes the receiving computer to add the newly received information to its ARP cache. Consequently, if the gateway computer were to receive a SPOOFED ARP REPLY from an attacking computer claiming that it was assigned an IP that belonged to some other computer, the gateway would trustingly and blindly REPLACE its current correct entry with the maliciously misleading replacement! If at the same time the malicious attacking computer were to send a similar ARP reply to the computer being hijacked, maliciously replacing the ARP cache entry for the gateway computer, then any subsequent traffic bound for the gateway would instead be sent to the attacking computer. If the attacker forwards any of the redirected traffic it receives onto the proper original computer - after inspecting and perhaps even modifying the data - neither of the intercepted computers will detect that all of their communications is now being relayed through an unknown and probably malicious intermediary computer. By merely injecting two ARP reply packets into a totally trusting LAN, any malicious computer is able to receive all traffic going back and forth between any two computers on the LAN such as any target machine and the LAN's gateway.