1. Monkey In The
Attack
Middle
Hangin on with Ubuntu
(arpWall projekt snapshot)
y3 dips | RITECH 2007

2. OUR TA SK
• Spoiler, Intro, about
• Arp brief, Arp attack
• Ubuntu, arpwatch, swatch, gtk2-perl,
arpWall
• Shortcut, Conclusion
y3 dips | RITECH 2007

3. SP OIL ER
Believe me !, there isn`t any monkey
was harm for this presentation
y3 dips | RITECH 2007

4. IN TR O
• I am y3dips
• Stuck in IT Security & Hacking since 2002
• Wrote articles, tips&tricks, advisories
• Founder of echo.or.id & ubuntulinux.or.id
• Another Comp/Inet/Net:Security Junkie
y3 dips | RITECH 2007

5. ABOUT A MONK EY
• It Could`ve be every Man/Woman
• Always Mess Around
• Know Nothing
• Less knowledge
• Using some friendly tools
(cain & abel)
• A kiddie
y3 dips | RITECH 2007

6. ARP BR IEF
• Address Resolution Protocol
• Map IP network addresses to the
hardware addresses
y3 dips | RITECH 2007

7. Images taken from: http://www.micr*soft.com
y3 dips | RITECH 2007

8. ARP ATTA CK
• ARP spoofing aka ARP poisoning
y3 dips | RITECH 2007

9. ARP ATTA CK ( SP OO FING)
• Send ‘fake’ or 'spoofed', ARP
messages to an Ethernet LAN. These
frames contain false MAC addresses,
confusing network devices (e.g
switches)
• As a result frames intended for one
machine can be mistakenly sent to
another
Source : wikipedia.org
y3 dips | RITECH 2007

10. Images taken from:dips | RITECH 2007
y3 http://www.acm.org

11. ARP ATTA CK ( IMP ACT)
• Sniff data frames
• Modify the traffic
• Stop the traffic (denial of
services)
y3 dips | RITECH 2007

12. Arp Atta ck (to ols)
• ArpSpoof.c
• Nemesis
• Dsniff
• Ettercap-NG
• Cain & Abel
• etc …
y3 dips | RITECH 2007

13. y3 dips | RITECH 2007

14. y3 dips | RITECH 2007

15. STAND TALL AS A HUMAN
http://www-user.tu-chemnitz.de/~fri/test/Evolution-man.jpg
y3 dips | RITECH 2007

16. DEFEN CE AS A HUMA N
• Ubuntu GNU/Linux
• Arpwatch
• Swatch
• Perl-gtk
• arpWall
y3 dips | RITECH 2007

17. UBU NTU
• Ubuntu is an African word meaning
‘Humanity to others‘
• Community developed
• Debian GNU/linux-based operating
system
• 2004 (4.10/warty)
• Been number 1 for a long time
y3 dips | RITECH 2007

18. ARPWA TCH
• Monitors mac adresses on your
network and writes them into a file
• http://freequaos.host.sk/arpwatch/
– Latest release arpwatch NG 1.7
• Sudo apt-get install arpwatch
y3 dips | RITECH 2007

19. y3 dips | RITECH 2007

20. SWA TCH
• The active log file monitoring tool
• http://swatch.sourceforge.net/
– Latest rilis version 3.2.1
• Sudo apt-get install swatch
y3 dips | RITECH 2007

21. y3 dips | RITECH 2007

22. GTK2-P ER L
• The collective name for a set of
perl bindings for Gtk+ 2.x and
various related libraries
• These modules make it easy to write
Gtk and Gnome applications
• http://gtk2-perl.sourceforge.net/
y3 dips | RITECH 2007

23. y3 dips | RITECH 2007

24. AR PW ATCH
SWAT CH
GTK 2-PE RL
+
?
y3 dips | RITECH 2007

25. y3 dips | RITECH 2007

26. ARPWA LL
• This tools will give an early
warning when arp attack occurs and
will simply block the connection
• http://arpwall.sf.net (ver 0.0.1)
• Based on arpwall + swatch + gtk2perl
• Need time? And idea?
y3 dips | RITECH 2007

27. y3 dips | RITECH 2007

28. SH OR TCUT
• Set Static Arp Table
• Sudo arp –s [ip] [mac address]
• Would be a problem
• Still Not 100% surely Secure
y3 dips | RITECH 2007

29. y3 dips | RITECH 2007

30. CONCL USION
• Fix MAC for each device port
• Using another good Authentication
than using MAC address
• Good Network Configuration
• Segmentation (e.g VLAN)
• Monitoring machine
y3 dips | RITECH 2007

31. CONCL USION ( END USER )
• Using arpwatch-ng, X-arp, arp-guard,
or other arp-defend-application
• using Secure connection (SSL, SSH,
IPSec) even still potentially
attacked
y3 dips | RITECH 2007

32. THAT S ALL
FOL KZ
Have Somethin to Discuss?
(talk talk talk)
y3 dips | RITECH 2007