Question

Difficulty: EasyCommon Network Attack Types and Vectors

A network administrator discovers that hosts on a local subnet are directing default gateway traffic to an unauthorized computer's MAC address. An inspection reveals that the ARP caches on the affected hosts associate the default gateway's IP address with the attacker's MAC address. Which of the following statements correctly describe the mechanisms or impact of this network security attack? (Select TWO)

  1. The attacker transmits unsolicited ARP responses containing forged IP-to-MAC address mappings to poison host ARP tables.Answer
  2. This attack allows the threat actor to establish a Man-in-the-Middle (MitM) position to inspect or tamper with local subnet traffic.Answer
  3. C
    The attack vector relies on modifying remote DNS server zone files to misdirect host name resolution requests.
  4. D
    The threat actor uses open connectionless UDP ports on public servers to amplify attack traffic toward the target.

Answer

The correct statements are that the attacker transmits unsolicited ARP responses containing forged IP-to-MAC address mappings to poison host ARP tables, and that this attack allows the threat actor to establish a Man-in-the-Middle (MitM) position to inspect or tamper with local subnet traffic.
The scenario describes ARP poisoning (or ARP spoofing). In an ARP poisoning attack, a malicious actor broadcasts unsolicited gratuitous ARP replies containing spoofed Layer 2 address mappings. Endpoints receive these updates and modify their local ARP tables, routing traffic intended for the default gateway directly to the attacker. This configuration enables a Man-in-the-Middle (MitM) position, giving the attacker the ability to capture, analyze, or modify traffic before forwarding it to its actual destination.

Step-by-Step Solution

1
Analyze the observed anomaly and log evidence from the scenario.
The issue involves altered ARP table entries on a local subnet mapping the gateway's IP to an unauthorized host MAC address.
Identifying that MAC-to-IP binding manipulation is occurring at Layer 2 points directly to an ARP poisoning/spoofing attack.
2
Evaluate the mechanism used by ARP poisoning.
Attackers send forged, unsolicited (gratuitous) ARP reply messages across the local broadcast domain.
Hosts accept these ARP replies and update their local cache tables, directing frame traffic intended for the gateway to the attacker.
3
Determine the impact of successfully poisoning local ARP caches.
The attacker achieves a Man-in-the-Middle (MitM) posture.
Traffic destined for off-subnet destinations flows through the attacker's system before reaching the real default gateway.

Key Concept

ARP Poisoning and Man-in-the-Middle (MitM) Attacks
Rate this question