Ettercap, Arpwatch, security - argh!

Herodot

Hi,

there are about 50 apartments in my building, and we share an internet connection. We have a LAN with switches and a router/gateway/NAT. It works quite well. Or so I thought... Last night I discovered, to my horror, that from my machine I can sniff everybody's passwords to mail and chats and whatnot, using Ettercap. Through switches. Not good, not good at all. There are forums for Ettercap, but they are mostly concerned with telling everybody that no systems are safe and to RTFM. So I turn to the much nicer Gentoo forums.

1) Ettercap (apparently) work by arp-spoofing (or mac-spoofing or dns-spoofing if that fails...). I'm not too sure exactly how, but setting a "static arp" should help. How do I do that for my Gentoo box?

2) That won't resolve the problem, which I think is that our gateway (a hardware box of some sort, not a computer) is arp-spoofed. So I think we need a computer to act as a gateway/DHCP/NAT/whatever, and give that a static arp. Is that correct?

3) Until that is done, the program Arpwatch can help alerting me if somebody is sniffing our net. Right? There is close to no documention for Arpwatch, but I think it can mail me if it detects foul play - right? Do I need to set up a smtp server on the machine running arpwatch, or how does that work?

4) What can I read to learn about these things? (free, online stuff much preferred)

5) What else can I do?
_________________
Excelsior!

Supermule · Guru Joined: 05 Mar 2003 Posts: 510 Location: /denmark/fyn

Herodot · Posted: Sun Jun 01, 2003 5:13 pm Post subject:

Hi,

thank you for your answer.

My main concern isn't attacks from the outside. Our common NAT doesn't allow anything incoming, so that's probably reasonably secure.

My problem is that everybody on the inside can simply run Ettercap and get everybody's mail passwords and more.

Running arpwatch will likely tell if anybody is arpspoofing, but I don't know how to get arpwatch to let me know if that is happening. I can do "grep arpwatch /var/log/everything/current" and try to understand what's happening, but I can't spend all my time doing that.

Getting some sort of automated supervision of the network is my first priority.
_________________
Excelsior!

bryon · Apprentice Joined: 14 Feb 2003 Posts: 163

I know that ettercap has a plugin that can monitor for arp poising, an you will get a little notice on the screen if the arp cache is poisoned.

CinqueX · n00b Joined: 26 Jan 2003 Posts: 58

The only real solution for you is to avoid un-encrypted services. It's time to migrate to sftp/imapd-ssl/pop-ssl/https etc etc. you are fairly screwed unless you can convince your ISP admin to plug you directly into an isolated switch port. It sounds like you might be plugged into just a dumb hub and are seeing all traffic on your segment.

Ettercap isn't the only tool, you are vulnerable to any packet sniffer, or net i/f in promiscuous mode.

Regards,

C.

Herodot · Posted: Mon Jun 02, 2003 10:50 pm Post subject:

OK, I'll repeat in simpler terms:

I'm on a switched network.
Ettercap can do arp spoofing, and it can collect pop3 passwords from everybody on the network.
Arpwatch can possibly monitor the arps tables. It may be able to alert me if somebody tries to run Ettercap.

Can anybody help me with Arpwatch? There's no documentation.
_________________
Excelsior!

BlueShift · Posted: Tue Jun 03, 2003 9:54 am Post subject:

Hi,

Sorry, can't help you with Arpwatch, I havn't used it.
Setting a static arp table on the gateway will prevent this man-in-the-middle attack (I think, only learned about this problem last week so I am not reaaly an expert on the subject) But I think it will also prevent someone from changing [his/her] [network card/computer] so maybe this creates more problems than it solves.
The advise on the Ettercap forums may not be what you want to hear but I think it's the best advise there is. If you want security, be paranoid.
CinqueX also has a good point, there is no excuse for sending unencrypted passwords over a network.
Sorry if this in not very helpfull.
Greetings,

Jan.

barlad · l33t Joined: 22 Feb 2003 Posts: 673

Indeed setting up a static ARP table is not a viable option as soon as you have a lot of computers on which you have barely no control. As soon as someone wants to change his IP local adress for whatever reason, or even if he changes his network card, you have to update the cache. If one uses does it once a week, that's fine... if 50 users do it once every 2 day, that's less "fine".

Second solution someone stated is to make it so that you are on your own port. That won't work. All you have to do is some MAC adress spoofing to get some of the traffic redirected. That's easily spottable but if the admin does not pay much attention or has no specific software warning him, it will go through without a problem. Same problem if the switch is not properly configured or has no security.

Third solution, arpwatch. Arpwatch can only monitor its own segment of the local network. It's pretty straight forward to set-up. To get the documentation, grap the tarbal, untar it, install the package manually (./configure && make && make install) then isntall the docs : make install-man. You will have arpwatch and arpsnmp documentations. You will get all the changes in IP adress and MAC adress that were done to the cache. I can think of a few ways to bypass it though.

Like someone said, there is only one solution to this problem: encryption. Everything should be crypted. That would solve 90% of the problems.

oh about setting a static ARP to the gateway. That would only solve a part of the problem. MAC spoofing would still work to get the incoming traffic (again, easily spottable)

paranode · l33t Joined: 06 Mar 2003 Posts: 679 Location: Texas

If the switch you are on is operating in spanning tree mode (ie acting like a hub) due to too much traffic or whatever, then even static ARP assignments won't help your case. Anyone can run a program like Ethereal and watch traffic sent out over the ether. I am on a switched network myself but once in a while the switch goes into spanning tree mode because of traffic volumes and you can see when it happens if you are watching the traffic. So it's strongly advised to avoid cleartext password and sensitive data transmission if it can be avoided.
_________________
Meh.

Herodot · Posted: Tue Jun 03, 2003 1:10 pm Post subject:

barlad · l33t Joined: 22 Feb 2003 Posts: 673

Herodot · Posted: Tue Jun 03, 2003 3:49 pm Post subject:

paranode · l33t Joined: 06 Mar 2003 Posts: 679 Location: Texas

Herodot · Posted: Tue Jun 03, 2003 4:27 pm Post subject:

"Harry Potter has caught the switch!"

barlad · l33t Joined: 22 Feb 2003 Posts: 673

"Theorically" MAC adress are unique. That's the theory since you can actually modify your MAC adress.

Anyway, if two computers have the same MAC adress, if I may be rude, it's one of those time when you can say that "shit hits the fan".
Basically, switch will keep updating their CAM with new mac adress and traffic to the two concerned computers will be corrupted.

That's why you have to DoS the target before doing some MAC spoofing so that it can't send traffic and get the CAM updated.

paranode · l33t Joined: 06 Mar 2003 Posts: 679 Location: Texas

purecaca · n00b Joined: 10 Jul 2002 Posts: 10 Location: Denmark

Herodot

Get some managed switches that support VLANS (recomend HP, cheaper/faster than cisco switches, if you just want to use VLANs)

Then give each apartment each own VLAN, and setup an gentoo box as firewall that listen on all the vlans (use vconfig to create the vlan interfaces (remember to compile 802.1Q vlan support in the kernel))

Works and works quite well
(i got something like that running with gentoo:
7xHP 24port managed switches, and then create an vlan trunk(might not be the right word for it) that caries all the VLANs to the gentoo box's internal nic), then just set up iptables to deny any traffic from any vlan to another vlan (using shorewall for simpler management of the iptables rules)

Then just give each vlan its own interface fx:
vlan5: 10.5.0.1/16 (the apartment can then use 10.5.* for its PCs)
vlan6: 10.6.0.1/16 (the apartment can then use 10.6.* for its PCs)
vlan7: 10.7.0.1/16 (the apartment can then use 10.7.* for its PCs)
vlan8: 10.8.0.1/16 (the apartment can then use 10.8.* for its PCs)
vlan9: 10.9.0.1/16 (the apartment can then use 10.9.* for its PCs)
vlan10: 10.10.0.1/16 (the apartment can then use 10.10.* for its PCs)
(you get the point, and should some of the users think of using one of the other aparments IP ranges, then they wont be able to access anything at all)

Then there is no way in hell other users can sniff any other users traffic

(written in a hurry, maybe i should write a small howto on this in gentoo, so nice with VLANs in linux

)

fgarbrecht · n00b Joined: 27 May 2003 Posts: 43 Location: Philadelphia

That would be some monster Gentoo box to handle firewalling for 50 apartments, each on its own VLAN!

purecaca · n00b Joined: 10 Jul 2002 Posts: 10 Location: Denmark

actually not

a decent P4/Celeron/Athlon + 2 Intel/3Com Server Nics (dont think it will work so great with cheap realtek cards though) would do just fine. (if we are talking about internet sharing (~ <100Mbit to internet)

fgarbrecht · n00b Joined: 27 May 2003 Posts: 43 Location: Philadelphia

I was thinking of an architecture where the firewall would be placed internal to the switch, in which case you would need a separate nic for each VLAN to control (deny) inter-VLAN routing, (which would require one heck of a PCI bus

). I'm not sure how one would configure this otherwise to prevent one apartment from sniffing the traffic to/from another one. You have to have some distribution point (multi-homed router/firewall, hub, switch or combination thereof) going out to each apartment. If you're using a multi-homed box set up correctly, I can see how you could secure this as a firewall, but if the final embarcation point is a switch or hub, obviously sniffing becomes trivial. What am I missing here :?:

eagle_cz · Apprentice Joined: 06 Jun 2003 Posts: 214

set static arps on switch and be happy

catalyst 2950 provide many interesting functions

purecaca · n00b Joined: 10 Jul 2002 Posts: 10 Location: Denmark

fgarbrecht

You cant just send all the VID on a single port and connect that to the firewall, i have done this and it works, it completely imposible to access the other VLANs (the firewall should ofcourse not route between the vlans (and the switch either))

Setup like

fgarbrecht · n00b Joined: 27 May 2003 Posts: 43 Location: Philadelphia

purecaca

Hi - I was just concerned that an internal intruder could flood the switch; if the switch fails open, the vlans aren't of much use, and if the switch fails closed then the intruder has dos'd the network.

fg

purecaca · n00b Joined: 10 Jul 2002 Posts: 10 Location: Denmark

the users isnt on the same vlan as the switch management (often VID1), so cant see how that should be possible at all.

samokk · Posted: Fri Jun 13, 2003 1:37 pm Post subject:

Try running snort, it has a plugin to check arp spoofing, etc.

then you can be notified by mail or whatever

sam