>> Hello. We just talked about Smurf
and fraggle attacks and how they
involve spoofing the source address.
There's all sorts of spoofing.
In addition to IP address spoofing,
MAC address spoofing is really
common because a lot of times
switches are set up to only allow
specific MAC addresses to connect.
But MAC spoofing is as easy as any other type.
Email spoofing is where an attacker makes
a message look like it came from
your bank or some other entity,
and caller ID spoofing is where an attacker
spoofs the number that your caller ID shows you.
You think it's coming from someone you
trust but it's actually not.
Spoofing is all about impersonation and
usually when we're talking about IP or MAC spoofing,
it's all about modifying the source address
so it looks like it comes from somewhere else.
Now, with redirection attacks,
the attacker's goal is to send you to a server that
spoofed to look like a legitimate server or service.
Maybe you'll log into an Internet server but
the attacker has redirected you to
his web server that looks like yours.
It has a field for username and password,
and you type in your normal username and password.
But then the site displays a message that it's
temporarily unavailable and to try again later.
But now the attacker has your username and password.
A redirection is very common.
The attacker can send you to
the wrong DNS server or modify your cache.
But ultimately, if the attacker is able to
redirect you to his rogue site, at the very least,
it's a man in the middle attack and
the attacker can intercept information
like usernames and passwords
or financial information and so forth.
Redirection is something to be really concerned about.
Now, Address Resolution Protocol, or ARP,
is something that takes a known IP address and
is used to find out an unknown MAC address.
It sends out a broadcast that is basically
something like "Is anybody out there?
Host IP address 10, 1,1,1,"
>> and the host responds,
>> "That's me, here's my MAC address."
Once my client system has that information,
it stores it in the ARP cache or ARP cache.
Then the next time I need to send
that out to the IP address,
I don't have to broadcast out.
That information is stored in my cache.
If someone is able to modify that information,
then they can redirect me.
A cache is just the same regardless of whether it's
ARP or DNS or any other type of cache.
It's where we store information
>> that we're going to need
>> frequently so that way
we can access it quicker in the next time.
Anytime you hear about poisoning,
it means modifying the cache.
It's almost always for the purpose of redirecting.
DNS controls the world.
If I can redirect you to a bogus DNS server,
every time you type out the name of the server,
you're going to go where my DNS server sends you.
Obviously, that's very powerful.
Pharming is associated with modifying DNS records.
DNS keeps track of where your critical servers and
services are and if someone modifies that information,
then again, redirection can occur.
In addition to DNS,
there's also a static text file that
resides on client system called the host file,
and a host file was one of the tools we used for
name resolution before a DNS
was as efficient as it is today.
There would be a static host file that would
indicate that if someone types in server one,
then they should be sent to IP address 1,1,1,1.
But even though we don't use that today as
our primary source of name resolution,
the host files is still there.
If someone were to modify my hosts file,
they can redirects me as well.
It's worth it to learn our DNS
because it's such a powerful service.
We'll talk more about that next.