Computer Networks - Final Year Project

Replies

• 

  Kaustubh Katdare

  Thread moved to IT engineering section.
• 

  durga ch

  I seem to understand where you are coming from, but I need further deatils to conclude. For example- when you are reading cisco independent work, the solution might be limited only for cisco devices , and might not be a standardised approach, so while few other papers might suggest the problem still persists , cisco papers might state its sovled. Have you checked further, what are the loopholes in the suggestions made by cisco papers?I would suggest read the latest published information, may be in past 2 yrs nothing older than that. That should help you to assertain till what extend the work has been completed.
  As I currently browse internet for already existing solutions for the MITM attack, i can see work being done at MIT as well, (i did not read all the approaches) but selecting one of them and try to implement it.
• 

  ceaalop

  thanks for your reply. I found this link: #-Link-Snipped-# from SANS and it describes some configuration commands that can be done on Cisco routers in order to mitigate ARP cache poisoning attacks. However the article also says that equivalent commands are also available on Brocade, HP and most other router/switches on the market. 😔
  
  I do not know if my thinking is right here, but I thought maybe I should test these mitigations techniques in a wireless hotspot environment and then document about whether there are any problems with them or if they work at all in such an environment. For example one technique mentioned in this website is DHCP snooping and I do not know whether such a technique can be used in a Wi-Fi hotspot scenario since it works by maintaining a table of MAC addresses and their corresponding IP addresses (similar to ARP table). Do you think that testing out these mitigations techniques in a wireless hotspot scenario and then documenting any problems with regards to factors such as performance and security still make this a valid thesis?
  
  With regards to the MIT research that you also mentioned I found some articles on the internet that said that MIT researchers have found a solution. Here's a detailed article if you're interested: #-Link-Snipped-#
  The other papers that I have read mostly suggested some alterations to the ARP protocol itself, however I will read some more so that I get a more information about the subject.
• 

  durga ch

  hello,
  
  after doing a little research over internet this is what i can contribute. DHCP snooping is just one for the ways in which MITM can 'hurt' the network. As mentioned in many documents, MITM problem can be hanlded by configuring all the ports by default as 'non-trustworthy' and reconfiguring only the port with the DHCP server as trusty port.
  For example-
  if host A and host B are conencted to a switch at ports 1 and 2 and DHCP server is conencted at port 6, the switch can be internally configured to restrict any DHCP replies from any other port than 6. Thus in case an attacker connects to port 7 and tries sending response, the switch simply discards. I beleive, this is the mitigation for MITM attacks and other network equipement manaufacturees too have their own command sets to configure the LAN switch in this fashion. This is all in wired LANs.
  
  Coming to wireless networks, rogue APs(access points) can be put up and the rougue AP can repsond as if its a authenticated AP to the communciating hosts. By far, I dont see a text describing mitigation of MITM in wireless networks. (I need to do further research).
  
  MITM techinuqes can be implemented as below:
  
  local area network:
  ARP poisoning
  DNS spoofing
  Port stealing
  STP mangling
  
  From Local to Remote(through gateway)
  ARP Poisoning
  DNS spoofing
  DHCP spoofing
  ICMP redirection
  IRDP spoofing
  route mangling
  
  remote:
  DNS poisoning
  traffic tunneling
  route mangling
  
  wireless:
  access point reassocation
  
  
  refer:- (documents are old , but give pretty good idea )
  1. #-Link-Snipped-#
  2. PDF
• 

  ceaalop

  thanks for your detailed reply 😀 . with regards to ARP poisoning attacks as far as I know they can also be performed on wireless local area networks using tools such as Cain & Abel (there are plenty of videos on youtube showing this type of attack ).
  
  Although I am interested on the subject of rogue APs and evil twin setups, I would like to focus on detection/mitigation of MITM attacks in a wireless hotspot environment where the attacker sits in between the client machine and the access point (so no additional APs will be involved). Given the amount of literature that is already available on ARP cache poisoning I'll probably focus on this type of MITM attack.
  
  This wiki article Arp Cache Poisoning contains a whole list of software/hardware that can be used in order to mitigate ARP cache poisoning attacks; but again the problem is I do not know whether these tools will work on wireless networks as well. In the coming days I'll read more about the detection and mitigation of MITM attacks on wireless networks so as to have a clearer picture.
  
  Sorry about the DHCP snooping part, didn't realize that it only worked on wired LANs. 😴
• 

  Bashiruddin Naik

  durga

  hello,
  
  after doing a little research over internet this is what i can contribute. DHCP snooping is just one for the ways in which MITM can 'hurt' the network. As mentioned in many documents, MITM problem can be hanlded by configuring all the ports by default as 'non-trustworthy' and reconfiguring only the port with the DHCP server as trusty port.
  For example-
  if host A and host B are conencted to a switch at ports 1 and 2 and DHCP server is conencted at port 6, the switch can be internally configured to restrict any DHCP replies from any other port than 6. Thus in case an attacker connects to port 7 and tries sending response, the switch simply discards. I beleive, this is the mitigation for MITM attacks and other network equipement manaufacturees too have their own command sets to configure the LAN switch in this fashion. This is all in wired LANs.
  
  Coming to wireless networks, rogue APs(access points) can be put up and the rougue AP can repsond as if its a authenticated AP to the communciating hosts. By far, I dont see a text describing mitigation of MITM in wireless networks. (I need to do further research).
  
  MITM techinuqes can be implemented as below:
  
  local area network:
  ARP poisoning
  DNS spoofing
  Port stealing
  STP mangling
  
  From Local to Remote(through gateway)
  ARP Poisoning
  DNS spoofing
  DHCP spoofing
  ICMP redirection
  IRDP spoofing
  route mangling
  
  remote:
  DNS poisoning
  traffic tunneling
  route mangling
  
  wireless:
  access point reassocation
  
  
  refer:- (documents are old , but give pretty good idea )
  1. #-Link-Snipped-#
  2. PDF

  Thanks for the details!!
  I looking for this..
• 

  ceaalop

  for anyone that is following this thread and is interested in wireless man-in-the-middle attacks, check this paper published by MIT researchers: PDF
  
  I'm reading it at the moment 😀