A network administrator discovers that hosts on a local subnet are directing default gateway traffic to an unauthorized computer's MAC address. An inspection reveals that the ARP caches on the affected hosts associate the default gateway's IP address with the attacker's MAC address. Which of the following statements correctly describe the mechanisms or impact of this network security attack? (Select TWO)
- The attacker transmits unsolicited ARP responses containing forged IP-to-MAC address mappings to poison host ARP tables.Answer
- This attack allows the threat actor to establish a Man-in-the-Middle (MitM) position to inspect or tamper with local subnet traffic.Answer
- CThe attack vector relies on modifying remote DNS server zone files to misdirect host name resolution requests.
- DThe threat actor uses open connectionless UDP ports on public servers to amplify attack traffic toward the target.
Answer
The correct statements are that the attacker transmits unsolicited ARP responses containing forged IP-to-MAC address mappings to poison host ARP tables, and that this attack allows the threat actor to establish a Man-in-the-Middle (MitM) position to inspect or tamper with local subnet traffic.
The scenario describes ARP poisoning (or ARP spoofing). In an ARP poisoning attack, a malicious actor broadcasts unsolicited gratuitous ARP replies containing spoofed Layer 2 address mappings. Endpoints receive these updates and modify their local ARP tables, routing traffic intended for the default gateway directly to the attacker. This configuration enables a Man-in-the-Middle (MitM) position, giving the attacker the ability to capture, analyze, or modify traffic before forwarding it to its actual destination.
Step-by-Step Solution
Key Concept
ARP Poisoning and Man-in-the-Middle (MitM) Attacks