Network Security Lecture: On-Path Attacks

1. Introduction to On-Path Attacks

• On-path attack: Attacker intercepts communication between two devices.
• Also known as Man-in-the-Middle (MitM) attack.
• Attacker relays and possibly alters communication between the devices.
• Victims are unaware of the attack, making it invisible to them.

2. ARP Poisoning

• Definition: ARP Poisoning (or ARP Spoofing) is a type of on-path attack occurring within a local subnet.
• Requirements: Attacker must be on the same subnet as the victim devices.
• Reason: ARP lacks security/encryption, making it vulnerable.

2.1. ARP Process

• Device asks for the MAC address of an IP via a broadcast.
• Target device replies with its MAC address.
• Information saved in ARP cache to avoid repeated requests.

2.2. ARP Poisoning Attack Example

• Victim Devices: Laptop (IP: 192.168.1.N, MAC: XY:38:D5) and Router (IP: 192.168.1.1, MAC: BB:FE).
• Attacker: IP: 192.168.1.114, MAC: EE:FF.
• Attacker sends falsified ARP reply claiming to have Router's IP with Attacker's MAC.
• Victim devices update ARP cache with Attacker's MAC.
• Results:
  • Traffic between laptop and router passes through attacker.
  • Attacker can monitor or alter traffic.
  • Attacker can disrupt communication.

3. On-Path Browser Attack

• Also known as Man-in-the-Browser attack.
• Involves malware/trojan acting as a proxy on the victim’s device.
• Captures traffic before/after it’s sent to the network, bypassing encryption.
• Impact:
  • Captures sensitive data like usernames, passwords (e.g., bank account info).
  • Allows attacker to create sessions and perform unauthorized actions (e.g., transferring money, online shopping).
• Visibility: Attack is invisible to the victim as everything appears normal.

Summary

• On-path attacks can severely compromise network security by intercepting, altering, and monitoring sensitive data.
• ARP poisoning attacks target local network vulnerabilities, while on-path browser attacks exploit malware to capture data on the victim's device.

Key Takeaways

• Always ensure networks and devices are properly secured against on-path attacks.
• Implement security measures such as encryption, authentication, and continuous monitoring for unusual activities.