3.1 Network Vulnerabilities and Attacks

Every device on a local network has an IP address (its network address, like 198.51.100.23) and a MAC address (a hardware ID built into its network card, like 00:00:5e:00:53:17). The address resolution protocol (ARP) builds a table that pairs each IP address with a MAC address, so the default gateway (the router that connects the local network to other networks) knows where to deliver traffic.

In ARP poisoning, an adversary sends fake ARP messages that link the target's IP address to the adversary's own MAC address. Traffic meant for the target now goes to the adversary. A related trick, making a device claim a MAC address that isn't really its own, is called MAC spoofing.

ARP poisoning is a kind of on-path attack (also called man-in-the-middle). The adversary sits between two parties, captures what each one sends, and may copy or change it before passing it on. Both sides think they're talking directly to each other.

• MAC flooding: the adversary sends a switch a huge number of Ethernet frames, each with a different fake MAC address. A switch normally sends each frame only to the port where its destination lives. When its address table overflows, it can fall back to broadcasting every frame to every port. Now the adversary receives everyone's traffic. Capturing data in transit like this is called eavesdropping, or sniffing.
• DNS poisoning: DNS (the domain name system) turns names like portal.example.com into IP addresses. The adversary pretends to be an authoritative name server and plants a fake record on a DNS server, so people who type the real name land on the adversary's look-alike site. That fake login page is credential harvesting: users type real usernames and passwords, and the adversary collects them.
• Smurf attack: the adversary sends many ICMP requests (the messages behind the ping command) to the network's broadcast address, faking the victim's address as the sender. Every device on the network replies to the victim at once, and the flood blocks legitimate traffic. Making a system unavailable like this is a denial of service (DoS). When many devices attack one target at the same time, it's a distributed denial of service (DDoS).

• No firewall, or a badly configured one, lets adversaries send traffic in to flood the network, map its internal layout or spoof a legitimate device.
• One compromised device becomes a launch pad for attacking others on the same local area network (LAN).
• An open data port on a switch without port security lets anyone who plugs in join the LAN and try DoS, MAC flooding or MAC spoofing.
• A rogue access point: an adversary plugs their own wireless access point into an open port and reaches the internal network wirelessly, maybe from outside the building, bypassing the firewalls.
• Wi-Fi that leaks outside the building lets adversaries pick up the signal and its beacon frames (announcements of the network's name and settings), then attempt eavesdropping or attacks on the encryption. Weak wireless encryption can be broken outright.
• Networks that don't authenticate devices and users let adversaries join and attack from inside.

Network weaknesses can hurt confidentiality (intercepted data), integrity (altered data in transit) and availability (DoS), and they can let adversaries move toward more critical systems. Automated vulnerability scanners check networks, devices and applications for known weaknesses and report each one with its severity and suggested fixes. Remember that many network exploits take advanced skill, which lowers their likelihood.