In this blog post, we’ll explore the principles, risks, and prevention methods of ARP spoofing, a simple yet devastating hacking technique.
Every so often, information security incidents occur and make major headlines. Various security incidents, such as distributed denial-of-service (DDoS) attacks and personal data breaches, have become social issues, and they are all very serious problems. However, in addition to these well-known attacks, there are hacking techniques that are structurally simple yet extremely dangerous. One of them is ARP spoofing.
Since “spoof” means “to deceive,” ARP spoofing literally refers to an “attack that deceives ARP.” So, what is ARP? ARP stands for Address Resolution Protocol, which is a protocol used to map IP addresses to MAC addresses. While this may sound somewhat technical, it’s easier to understand if you think of it as the process of delivering a package.
A MAC address is the physical address of a network device. Think of it as the actual location of the house receiving the package. For example, let’s assume there is a building towering halfway up Gwanak Mountain. If this building exists at a specific location, that is its physical address. Similarly, each computer’s network interface is assigned a unique MAC address. In contrast, an IP address is a logical address used for network communication. If the address of the building mentioned earlier were “Building 301, Seoul National University, 1 Gwanak-ro, Gwanak-gu, Seoul,” this would correspond to an IP address.
Now, let’s imagine a package that needs to be delivered to this building. The package has “Seoul National University, Building 301” written as the recipient’s address. However, it is difficult to pinpoint the exact location based on the address alone. While there are various ways to find the location, the easiest method is to use a map. Here, the map serves to link the address to the actual location; similarly, in a network, ARP performs the role of linking IP addresses to MAC addresses.
So, what is ARP spoofing? Simply put, it involves using a fake map. For example, let’s assume we’re communicating with a computer that has the IP address 111.222.111.222. However, since we don’t know the MAC address of the computer with that IP address, we send an ARP request packet asking, “Who has 111.222.111.222?” to the network. A packet is the basic unit for exchanging data over a network. This request is broadcast across the network, and the device with that IP address sends a response stating that it is the owner of that IP address, along with its MAC address. Afterward, the two computers communicate normally.
However, the situation changes if, during this process, a hacker—rather than the computer you were originally supposed to communicate with—sends a false response claiming to be the owner of that IP address. The user mistakenly identifies the hacker’s MAC address as the actual address for that IP, and ends up communicating with the hacker instead of the intended computer.
However, simply misconnecting the communication target does not in itself create a security issue; it merely prevents communication from occurring properly. So why is ARP spoofing such a dangerous hacking technique? The reason lies in how the attack is carried out.
Since there are countless computers worldwide, it is practically impossible to connect every computer directly to every other. Therefore, multiple computers are organized into a single network and connected to each other via routers to facilitate communication. The first device a packet sent from a user’s computer passes through is the default gateway. The default gateway serves as the link between a network and the outside world.
The user first sends an ARP request to determine the MAC address corresponding to the gateway’s IP address. If a hacker sends a fake response pretending to be the gateway, the user will mistake the hacker for the actual gateway. After that, all packets sent by the user are routed through the hacker. The hacker then forwards these packets to the actual gateway, making it appear as though communication is proceeding normally.
At the same time, the hacker sends a fake ARP response to the gateway in the same manner, causing packets that should originally be delivered to the user to be routed to the hacker instead. When these packets are then forwarded back to the user, it is difficult for the user to detect any abnormalities in the communication. This method, in which an attacker intervenes in the middle of communication, is called a man-in-the-middle (MITM) attack. Since the communication appears normal on the surface, it is very difficult for the user to recognize the attack.
However, in such a situation, the hacker can inspect all packets that the user sends and receives over the Internet. In other words, the hacker can intercept or tamper with most of the information traveling over the network—including the user’s login credentials, personal information, and transmitted data—which poses a very serious security risk.
Since ARP spoofing attacks exploit the way the ARP protocol operates, they are possible within the same network environment. However, the risk of such attacks can be significantly reduced by implementing security features in the operating system, ARP protection features in network equipment, and security technologies such as Dynamic ARP Inspection. It is also important for users to follow basic security practices, such as keeping antivirus software and firewalls up to date, avoiding unverified websites, and refraining from downloading or running files from unknown sources. These preventive habits are the most fundamental way to protect oneself not only from ARP spoofing but also from various other cyberattacks.
