In spoofing attacks, the attacker places a rogue DHP server on the network.
There are two main features of the DCPI mechanism that emerges, the spoofing attack.
First, there's no authentication process and priority in the mechanism.
Second, as clients are turned on and request an address, the server with a fastest response is used.
So if the device receives a response from the rogue server first, the rogue server can assign any address
as well as control which device it uses as a gateway.
So a well-designed attack can funnel traffic from local to a rogue server that logs all the traffic
and then forwards that traffic out to the correct gateway to the device.
And this action would be almost transparent, right?
That's the attacker can steal information pretty much invisibly.
Are you going to how are you going to find that?
That's why you're here.
Any clue you in on another important point, while setting up a rogue server, it's we cannot be so
sure whether the client received the settings of the rogue server or the legitimate server.
That's why it's way better to use the spoofing attack with a DCP starvation attack.
All right.
In a DHP starvation attack, an attacker broadcast a large number of DHP request messages with spoofed
source MAC addresses.
If the legitimate DHP server in the network starts responding to all these bogus DHP request messages,
available IP addresses and the server scope will be depleted within a very short span of time.
Now, once the available number of IP addresses in the server is depleted, network attackers can then
set up a rogue Ekpe server and respond to new DHP requests from the network DHP clients.
By setting up a rogue DHP server, the attacker can now launch a whole DHP spoofing attack.
So here is how we can perform a spoof attack together with DHP, Starvation Attack.
So we'll create a lot of DHP discovery packets to request new IP addresses from the DHP server.
DGP survey replies to these requests.
IP address space is limited.
For example, a class C subnet has about 250 IP addresses available.
So since the IP addresses are used for fake Mac addresses, there aren't any more IP addresses for legitimate
clients.
DHP cannot respond to the new requests and the clients, which cannot have IP addresses become out of
service.
So now we'll set up a rogue server, which is the only server to respond to the client's IP address
requests right now.
The rogue DHP server starts distributing IP addresses and other TCP IP configuration settings to the
network DHP clients.
TCP IP configuration settings include default gateway and DNS server IP addresses.
So now we can replace the original legitimate default gateway, I.P. address and DNS server IP address
with our own IP address.
Once the default gateway I.P. address of the network devices changed, the network clients start sending
the traffic destined to outside networks to the attackers computer.
The attacker can now captor's sensitive user data and launch a man in the middle of attack.