During a security incident investigation on a segmented corporate network, a technician notices that workstations on VLAN 10 are sending traffic intended for the local default gateway (10.10.10.1) directly to an unknown host's MAC address (00:50:56:AB:CD:EF). Analysis of network traffic logs reveals that the unknown host continuously transmits unsolicited Ethernet frames asserting ownership of IP address 10.10.10.1 without altering the victim clients' DNS configuration or DHCP lease parameters. Which of the following attack vectors is actively occurring, and what underlying mechanism enables this compromise?
- ARP poisoning, enabled by broadcasting forged Gratuitous ARP frames to overwrite host ARP caches within the local broadcast domain.Answer
- BDNS spoofing, enabled by injecting rogue AAAA and A resource records into legitimate name server cache responses.
- CDHCP starvation, enabled by exhausting available scope IP addresses via malicious requests sent over UDP ports 67 and 68.
- DVLAN hopping, enabled by injecting double-tagged 802.1Q frames to bypass inter-VLAN routing security controls.
Answer
ARP poisoning, enabled by broadcasting forged Gratuitous ARP frames to overwrite host ARP caches within the local broadcast domain.
The scenario describes ARP poisoning (ARP spoofing). Because the Address Resolution Protocol (ARP) lacks intrinsic authentication, an attacker on the same local Layer 2 broadcast domain can broadcast forged Gratuitous ARP (GARP) frames. These frames inform neighboring hosts that the default gateway's IP address (10.10.10.1) is now associated with the attacker's MAC address (00:50:56:AB:CD:EF). Consequently, victim workstations update their local ARP caches and forward all off-subnet traffic to the attacker, creating an On-Path (Man-in-the-Middle) attack vector.
Step-by-Step Solution
Key Concept
ARP Poisoning and Gratuitous ARP Exploitation
Estimated Time:2m 0s