We usually consider our network communication to be private.
We're communicating to a server, and we're
assuming that everything between our workstation and the server
is not going to be seen by other people.
The reality, of course, is far from that.
The bad guys would love to get into the middle of that
conversation, and they do this using a technique called
man-in-the-middle.
They're able to sit between you and that other device
and be able to watch all of the traffic going
between Point A and Point B. The bad guy acts as the middleman.
It's receiving information from one device,
looking at what's inside of it, and forwarding it
on to another device.
Neither end-station realizes that there's someone
in the middle who is sitting between that conversation,
and that's the secret of man-in-the-middle,
is that it is completely invisible to the end stations.
There's a technique that the bad guys use called ARP poisoning.
They're able to use some of the functions of ARP
because there is no security built into the Address
Resolution Protocol.
And by taking advantage of that lack of security,
it's very easy for the bad guy to create a man-in-the-middle
when they're sitting on the same IP subnet as two other devices.
Here's how this process works.
We've got two devices on this network-- there's
a workstation, there's a laptop that is 192.168.1.9,
and we also have a router on this network that
is 192.168.1.1, and you can see the MAC addresses
for each of those.
Now normally, when the workstation
needs to communicate out to the router,
it needs its MAC address.
So it sends an ARP request asking
who out there has the MAC address for 192.168.1.1?
That sends a broadcast to everybody on the subnet,
which means this router will see that request and it will
respond back saying, oh, I'm 192.168.1.1,
and here is my MAC address 00095, bravo delta 4,
bravo bravo fox echo.
And when that information gets to the workstation,
it will store that information so
that it doesn't have to constantly ask over
and over for that MAC address.
It stores it, makes a note that if I
need to get to 192.168.1.1, I'll use this MAC address
to communicate.
It's this ARP information the bad guys will take advantage
of.
Here's our bad guy at the bottom.
His IP address is 192.168.1.14, and you
can see the MAC address associated with him.
It's aa:bb:cc:dd:ee:ff, which should be something easy
to look for.
What the bad guy will do is send its own ARP request
to the workstation, saying that I am 192.168.1.1,
and here is my MAC address.
The end station sees that and puts into the ARP cache
the updated information.
So now the ARP has changed, and any time this workstation
is going to send information to the router,
it's going to send it to this device first, who
will then forward it on.
He is now the man-in-the-middle.
Let me give you a practical example
of performing an ARP poisoning.
I have a few windows up on the screen.
There's a browser window we're going
to use to log in to my local wireless router.
We've got a terminal screen here that we'll
use to look at my local ARP cache,
and then we have a remote desktop connection
to a third-party device that is running
a utility called Ettercap.
This Ettercap application is specifically designed
to provide man-in-the-middle functionality,
and we'll be using this utility to sit in the middle and watch
everything going back and forth.
The first thing I'd like to do is
to look at the ARPS that are currently stored in the ARP
cache on my machine.
So I'm going to type the command ARP-A,
and it's going to list out all the IP
addresses and the MAC addresses associated with those IP
addresses.
The device we're going to communicate to is 10.1.10.2,
and you can see the MAC address of that device ends in 403F.
That is, indeed, the MAC address of that wireless access
point, and if I was going to communicate to 10.1.10.2,
it would be communicating directly to that MAC address.
What we're going to do is tell Ettercap to sit in the middle
and use that ARP poisoning functionality to now look
at everything going back and forth between my workstation
and the wireless access point.
To do that, I'm going to choose on Ettercap that I'm
going to sniff the communication,
and I'm going to use what they call unified sniffing to sniff
all the traffic going in and out of one particular interface,
and on my device that is EN0.
So now it has started up.
It's now watching anything that happens
to come over that interface.
But because this is a switched configuration,
it's not going to see the communication back and forth
between my workstation and the wireless access point.
So we need to set up some targets into this.
I can either have Ettercap list out a number of IP addresses,
or I can specify the IP addresses myself
by selecting the targets myself and I can tell Ettercap what
I'd like these targets to be.
The first target is going to be my workstation,
and I know my workstation is 10.1.10.249,
and I also want to put the target
in of the wireless access point, and I know that its IP
address is 10.1.10.2.
Those are my two targets, and when I put those in, I can then
tell Ettercap to start MITM, man-in-the-middle ARP
poisoning.
And when I choose that option--
and I'm just going to use the default parameters--
it's going to say that there are poisoning victims now that
I've set up on this connection for Group 1 and Group 2,
and it's going to start performing a man-in-the-middle
across both of those.
Now the poisoning is set up and you
can see that Ettercap does show there's Group 1, which
shows the 10.1.10.249, that's my workstation,
and Group 2 that shows 10.1.10.2.
If we go back to our computer and perform another ARP dash A,
remember that the 10.1.10.2 originally
had a MAC address that ended in 43F,
and now if we perform the same ARP dash A,
you'll notice now the Mac address has changed.
So the man-in-the-middle ARP poisoning is currently
in effect.
And if I turn on Ettercap, show that screen,
and then go to that IP address, 10.1.10.2,
you will see that the first thing that pops up
is the message asking for a username and password.
This is already cached in the browser,
so you'll see that Ettercap even captures that first request,
which from 10.1.10.2, the users admin and the password
is Password One.
That is the correct username and password
by an admin and password one.
It will capture that information, again,
as it's going through and now I'm logged into the wireless
access point, and because Ettercap had
a man-in-the-middle ARP poisoning,
it's able to see all of the information going back
and forth even though it's not directly connected to either
my workstation or the wireless access point.
In our ARP poisoning example, we needed
to be on the local subnet where these devices were,
and the bad guys, of course, are not
usually on your local network.
So instead what they'll do is perform a man-in-the-middle,
but they'll do it from inside the browser.
We call this a man-in-the-browser attack.
They create a proxy on your system,
and simply send all the communication in and out
of the proxy on the same computer that you're using.
There's obviously huge advantages for the bad guys
to do this.
They can not only see all the traffic that normally would
be encrypted across the network because they're
on your local machine where the traffic is not encrypted,
and everything to the end user looks the same
as it always does.
And, of course, they don't need to be on your local network.
The man-in-the-browser can, for example,
wait for you to log into your bank,
capture those bank credentials, and then send that information
off to the bad guys who can then later on log in to the bank
and perform their own functions.
This obviously requires that the bad guys first
install this malware onto your machine that
acts as the middleman, but once it's inside the browser,
it can simply wait for that log in to your bank
and at that point on the same machine,
they can begin performing their own functions behind the scenes
that you don't even see.
But because they already have your credentials
and they're part of your browser,
they can now access your bank account
and perform any number of functions
because they now have all the credentials and all
of the capabilities as if they were you sitting
in front of your computer.