Há algum problema de segurança no ARP?
Sim. Aqui estão alguns:
-
ARP Spoofing.
Falsas mensagens ARP são enviadas por uma LAN, resultando na ligação do endereço MAC de um invasor com o endereço IP de um computador ou servidor legítimo na rede.
Veja abaixo mais informações sobre ARP Spoofing / Poisoning.
-
Inundação de MAC.
A tabela de conversão que rastreia quais endereços MAC estão em quais portas físicas tem uma quantidade limitada de memória. Isso permite que um switch seja explorado inundando a tabela de conversão. Os switches primitivos, sem saber como lidar com o excesso de dados, 'falharão' e transmitirão todos os quadros da rede para todas as portas.
-
Duplicação do MAC.
Em um ataque MAC Duplicating, um switch é confundido em pensar que duas portas têm o mesmo endereço MAC. Como os dados serão encaminhados para ambas as portas, não é necessário encaminhamento de IP.
Fonte Segurança do protocolo de resolução de endereços TCP / IP (ARP)
Por que o ARP foi substituído pelo NDP?
Ele fornece melhorias e recursos adicionais para o IPv6.
Veja abaixo uma comparação entre o protocolo NDP e os protocolos [ARP], ICMP Router Discovery [RDISC] e ICMP Redirect [ICMPv4].
Como o NDP se defende do ARP Spoofing / Poisoning?
Ele usa o protocolo Secure Neighbor Discovery (SEND). Os endereços gerados criptograficamente garantem que a origem reivindicada de uma mensagem do NDP seja o proprietário do endereço reivindicado.
One of the functions of the IPv6 Neighbor Discovery Protocol (NDP) is to resolve network layer (IP) addresses to link layer (for example, Ethernet) addresses, a function performed in IPv4 by Address Resolution Protocol (ARP). The Secure Neighbor Discovery (SEND) Protocol prevents an attacker who has access to the broadcast segment from abusing NDP or ARP to trick hosts into sending the attacker traffic destined for someone else, a technique known as ARP poisoning.
To protect against ARP poisoning and other attacks against NDP functions, SEND should be deployed where preventing access to the broadcast segment might not be possible.
SEND uses RSA key pairs to produce cryptographically generated addresses, as defined in RFC 3972, Cryptographically Generated Addresses (CGA). This ensures that the claimed source of an NDP message is the owner of the claimed address.
Fonte Configurando a descoberta segura de vizinho IPv6
Como funciona o ARP Spoofing?
O ARP Spoofing também é chamado de ARP Poison Routing (APR) ou envenenamento de cache ARP.
ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network.
Once the attacker’s MAC address is connected to an authentic IP address, the attacker will begin receiving any data that is intended for that IP address.
ARP spoofing can enable malicious parties to intercept, modify or even stop data in-transit. ARP spoofing attacks can only occur on local area networks that utilize the Address Resolution Protocol.
Veracode da fonte ARP Spoofing
Como um ARP Spoofing Attack funciona?
The steps to an ARP spoofing attack usually include:
The attacker opens an ARP spoofing tool and sets the tool’s IP address to match the IP subnet of a target. Examples of popular ARP spoofing software include Arpspoof, Cain & Abel, Arpoison and Ettercap.
The attacker uses the ARP spoofing tool to scan for the IP and MAC addresses of hosts in the target’s subnet.
The attacker chooses its target and begins sending ARP packets across the LAN that contain the attacker’s MAC address and the target’s IP address.
As other hosts on the LAN cache the spoofed ARP packets, data that those hosts send to the victim will go to the attacker instead. From here, the attacker can steal data or launch a more sophisticated follow-up attack.
Veracode da fonte ARP Spoofing
The attacker may choose to inspect the packets (spying), while forwarding the traffic to the actual default gateway to avoid discovery, modify the data before forwarding it (man-in-the-middle attack), or launch a denial-of-service attack by causing some or all of the packets on the network to be dropped.
Fonte Wikipedia ARP spoofing
Comparação [do NDP] com IPv4
The IPv6 Neighbor Discovery protocol corresponds to a combination of the IPv4 protocols Address Resolution Protocol [ARP], ICMP Router Discovery [RDISC], and ICMP Redirect [ICMPv4].
In IPv4 there is no generally agreed upon protocol or mechanism for Neighbor Unreachability Detection, although the Hosts Requirements document [HR-CL] does specify some possible algorithms for Dead Gateway Detection (a subset of the problems Neighbor Unreachability Detection tackles).
The Neighbor Discovery protocol provides a multitude of improvements over the IPv4 set of protocols:
Router Discovery is part of the base protocol set; there is no need for hosts to "snoop" the routing protocols.
Router Advertisements carry link-layer addresses; no additional packet exchange is needed to resolve the router's link-layer address.
Router Advertisements carry prefixes for a link; there is no need to have a separate mechanism to configure the "netmask".
Router Advertisements enable Address Autoconfiguration.
Routers can advertise an MTU for hosts to use on the link, ensuring that all nodes use the same MTU value on links lacking a well-defined MTU.
Address resolution multicasts are "spread" over 16 million (2^24) multicast addresses, greatly reducing address-resolution-related interrupts on nodes other than the target. Moreover, non-IPv6 machines should not be interrupted at all.
Redirects contain the link-layer address of the new first hop; separate address resolution is not needed upon receiving a redirect.
Multiple prefixes can be associated with the same link. By default, hosts learn all on-link prefixes from Router Advertisements. However, routers may be configured to omit some or all prefixes from Router Advertisements. In such cases hosts assume that destinations are off-link and send traffic to routers. A router can then issue redirects as appropriate.
Unlike IPv4, the recipient of an IPv6 redirect assumes that the new next-hop is on-link. In IPv4, a host ignores redirects specifying a next-hop that is not on-link according to the link's network mask. The IPv6 redirect mechanism is analogous to the XRedirect facility specified in [SH-MEDIA]. It is expected to be useful on non-broadcast and shared media links in which it is undesirable or not possible for nodes to know all prefixes for on-link destinations.
Neighbor Unreachability Detection is part of the base, which significantly improves the robustness of packet delivery in the presence of failing routers, partially failing or partitioned links, or nodes that change their link-layer addresses. For instance, mobile nodes can move off-link without losing any connectivity due to stale ARP caches.
Unlike ARP, Neighbor Discovery detects half-link failures (using Neighbor Unreachability Detection) and avoids sending traffic to neighbors with which two-way connectivity is absent.
Unlike in IPv4 Router Discovery, the Router Advertisement messages do not contain a preference field. The preference field is not needed to handle routers of different "stability"; the Neighbor Unreachability Detection will detect dead routers and switch to a working one.
The use of link-local addresses to uniquely identify routers (for Router Advertisement and Redirect messages) makes it possible for hosts to maintain the router associations in the event of the site renumbering to use new global prefixes.
By setting the Hop Limit to 255, Neighbor Discovery is immune to off-link senders that accidentally or intentionally send ND messages. In IPv4, off-link senders can send both ICMP Redirects and Router Advertisement messages.
Placing address resolution at the ICMP layer makes the protocol more media-independent than ARP and makes it possible to use generic IP-layer authentication and security mechanisms as appropriate.
Fonte Descoberta do vizinho RFC 4861 no IPv6