飞祥速递查询服务热线:剖析ARP中毒攻击

Hackers lie. Skillful hackers lie well. And well-rounded hackers can lie both to people and to machines.

       黑客们经常撒谎。有技术技术的黑客更善于撒谎。而思维缜密的黑客不仅对人，还能对机器撒谎。

Lying to people, known as "social engineering," involves tactics (detailed at length by convicted hacker Kevin Mitnick) such as posing as a company's employee so the company's real employees will blab secrets freely. Lying to machines involves lots of different techniques, and a commonly used one -- ARP Cache Poisoning -- is the focus of this article. ARP poisoning enables local hackers to cause general networking mayhem. Because it's mostly "incurable," every administrator should be aware of how this attack works.

       对人们撒谎，即所谓的“社会工程”，还包含了策略(已获罪的黑客Kevin Mitnick有具体实施)，例如假扮成一个公司的雇员这样就可以和真正的雇员交换公司机密。要骗过计算机则包括许多不同的技术，一个常用的是——ARP缓存中毒(ARP Cache Poisoning)——这是本文的核心。ARP中毒能让局域网内的黑客在其网内造成巨大的网络破坏。由于它通常是“不可治愈”的，因此每一个网络管理员都应该明白这种攻击究竟是如何进行的。

                                      ARP Refresher

                                            回顾ARP

In Foundations: What Are NIC, MAC, and ARP?, we explained that Address Resolution Protocol (ARP) is how network devices associate MAC addresses with IP Addresses so that devices on the local network can find each other. ARP is basically a form of networking roll call.

       在“计算机网络基础：什么是NIC, MAC和ARP?” ( 参见译者的这篇译文 ) 一文中，我们解释了地址解析协议 (ARP, Address Resolution Protocol) 是如何将网络设备的MAC地址和其IP地址关联起来的，这样在同一个局域网内的设备就能相互知道彼此的存在。ARP基本上就是一种网络上的点名。

ARP, a very simple protocol, consists of merely four basic message types:

       ARP，一个十分简单的协议，仅仅只包含了4种消息类型：

   1.   An ARP Request. Computer A asks the network, "Who has this IP address?"

       1.  ARP请求。计算机A询问整个局域网，“Who has this IP address?” (“谁的IP地址是这个？”，英文为本来报文里的ASCII码消息，译者注)

     2.  An ARP Reply. Computer B tells Computer A, "I have that IP. My MAC address is [whatever it is]."

       2.  ARP响应。计算机B告诉计算机A，“I have that IP. My MAC address is [whatever it is].” (我的IP地址是那个。我的MAC地址是[XX:XX:XX:XX:XX:XX])

     3.  A Reverse ARP Request (RARP). Same concept as ARP Request, but Computer A asks, "Who has this MAC address?"

       4.  反向ARP请求。和ARP请求的概念一样，但是计算机A询问，“Who has this MAC address?” (谁的MAC地址是这个？)

    4.  A RARP Reply. Computer B tells Computer A, "I have that MAC. My IP address is [whatever it is]"

       4.  反向ARP响应。计算机B告诉计算机A，“I have that MAC. My IP address is [whatever it is]” (我的MAC地址是那个。我的IP地址是XXX. XXX. XXX. XXX)

All network devices have an ARP table, a short-term memory of all the IP addresses and MAC addresses the device has already matched together. The ARP table ensures that the device doesn't have to repeat ARP Requests for devices it has already communicated with.

       所有的网络设备都有一个ARP映射表，就是内存里的一小段存储着目前该设备已经匹配的IP地址和MAC地址对。ARP映射表确保该设备不会向它已经通讯过的设备重复发送ARP请求。

Here's an example of a normal ARP communication. Jessica, the receptionist, tells Word to print the latest company contact list. This is her first print job today. Her computer (IP address 192.168.0.16) wants to send the print job to the office's HP LaserJet printer (IP address 192.168.0.45). So Jessica's computer broadcasts an ARP Request to the entire local network asking, "Who has the IP address, 192.168.0.45?" as seen in Diagram 1.

       这里是一次常规的ARP通信的例子。Jessica，一个接待员，告诉Word(指我们使用的微软文档编辑器，译者注)打印最新的公司通信录。这是她今天的第一个打印任务。她的计算机 (IP地址是192.168.0.16) 希望发送这个打印任务到办公室的惠普LaserJet打印机 (IP地址是192.168.0.45)。所以Jessica的计算机就会像整个局域网广播一个ARP请求去询问，“Who has the IP address, 192.168.0.45?” (谁的IP地址是192.168.0.45?)，如图1.

All the devices on the network ignore this ARP Request, except for the HP LaserJet printer. The printer recognizes its own IP in the request and sends an ARP Reply: "Hey, my IP address is 192.168.0.45. Here is my MAC address: 00:90:7F:12:DE:7F," as in Diagram 2.

       局域网内所有的设备都会忽略这个ARP请求，除了惠普LaserJet打印机。这台打印机发现它的IP地址就是请求里的IP地址，于是它发送一个ARP响应：“嘿，我的IP地址是192.168.0.45. 这是我的MAC地址：00:90:7F:12:DE:7F”，如图2.

Now Jessica's computer knows the printer's MAC address. It sends the print job to the correct device, and it also associates the printer's MAC address of 00:90:7F:12:DE:7F with the printer's IP address of 192.168.0.45 in its ARP table.

       现在Jessica的计算机知道了这台打印机的MAC地址。它现在能将这个打印任务发给正确的设备(打印机，译者注)，并且在它的ARP映射表里将打印机的MAC地址00:90:7F:12:DE:7F和它的IP地址192.168.0.45关联起来。

       Hey ARP, Did You Know Gullible Is Not in the Dictionary?

                         嘿ARP，你知道那个骗你的设备不在你的字典

                   (就是映射表，因其功能和字典差不多，译者注) 中吗？

The founders of networking probably simplified the communication process for ARP so that it would function efficiently. Unfortunately, this simplicity also leads to major insecurity. Know why my short description of ARP doesn't mention any sort of authentication method? Because in ARP, there is none.

       网络的设计者可能出于高效的考虑将ARP的对话过程设计得如此简单。不幸的是，这种简单也带来了巨大的安全隐患。知道为什么在我对ARP的简短描述中没有提到任何形式的认证方法吗？答案是，ARP根本就没有。

ARP is very trusting, as in, gullible. When a networked device sends an ARP request, it simply trusts that when the ARP reply comes in, it really does come from the correct device. ARP provides no way to verify that the responding device is really who it says it is. In fact, many operating systems implement ARP so trustingly that devices that have not made an ARP request still accept ARP replies from other devices.

       ARP认为通信双方都是安全可信的，实际上就是好骗的。当一个网络中的设备发出去一个广播ARP请求时，它只是简单的相信当收到一个ARP响应时，这个响应真的是来自正确的设备 (因为按照协议只有IP地址对应的设备才会发出相应报文，译者注)。ARP没有提供任何方法去认证响应的设备就真是如它报文里所说的那台。实际上，许多操作系统实现ARP时都是尽管没有发出任何ARP请求但仍然接受来自其他设备的ARP响应。

OK, so think like a malicious hacker. You just learned that the ARP protocol has no way of verifying ARP replies. You've learned many devices accept ARP replies before even requesting them. Hmmm. Well, why don't I craft a perfectly valid, yet malicious, ARP reply containing any arbitrary IP and MAC address I choose? Since my victim's computer will blindly accept the ARP entry into its ARP table, I can force my victim's gullible computer into thinking any IP is related to any MAC address I want. Better yet, I can broadcast my faked ARP reply to my victim's entire network and fool all his computers. Muahahahahaa!

       好了，想象自己是一个恶意的黑客。你刚刚才知道ARP协议没有任何认证ARP响应的方法。你已经知道了很多设备在没有发出任何请求的情况下仍然接受响应。嗯，我为什么不能制造一个完美有效但是恶意的，包含任何我自己选择的IP地址和MAC地址的ARP响应报文？由于受害者的计算机会盲目地接受这个ARP响应并添加到它的ARP映射表中，因此让受害者那极易受骗的计算机将任何我选的IP地址关联到任何MAC地址。更进一步，我能广播我做的假冒ARP响应到受害者的整个网络中，欺骗网络中所有的计算机。哇哈哈哈哈！

Back to reality. Now you probably understand why this common technique is called ARP Cache Poisoning (or just ARP Poisoning): the attacker lies to a device on your network, corrupting or "poisoning" its understanding of where other devices are. This frighteningly simple procedure enables the hacker to cause a variety of networking woes, described next.

      回到现实中来。现在你可能知道了为什么这种常用技术叫做ARP缓存中毒 (或者叫ARP中毒)：攻击者欺骗你的局域网中的设备，误导或者 “毒害” 它所知道其他设备的位置。这种恐怖而又简单的攻击使攻击者给网络带来了巨大的危害，后面将会描述到。

                                      All Your ARP Are Belong To Us!

                                   你的所有ARP报文都是我们的！

The ability to associate any IP address with any MAC address provides hackers with many attack vectors, including Denial of Service, Man in the Middle, and MAC Flooding.

       这种使攻击者能关联任何IP地址和MAC地址的能力让其可以进行很多种攻击，包括拒绝服务攻击(DoS, Denial of Service)，中间人攻击(Man in the Middle)和MAC洪泛(MAC Flooding)。

Denial of Service

拒绝服务

A hacker can easily associate an operationally significant IP address to a false MAC address. For instance, a hacker can send an ARP reply associating your network router's IP address with a MAC address that doesn't exist. Your computers believe they know where your default gateway is, but in reality they're sending any packet whose destination is not on the local segment, into the Great Bit Bucket in the Sky. In one move, the hacker has cut off your network from the Internet.

       一个黑客可以只做简单的操作就将一个重要的IP地址和一个错误的MAC地址绑定。例如，黑客可以发送一个ARP响应报文 (到你的计算机) 将你所在网络的路由器 (即我们常说的网管，译者注) IP地址和一个根本不存在的MAC地址绑定起来。你的计算机以为它知道默认网关在哪，但是事实上它的所有数据包，其目的地址都不在这个网络的网段上 (因为那个不存在的MAC不在此局域网的网段上，译者注) ，它们最后消逝在了无尽的比特流中 (即因数据包的生命周期到了而信号消失，译者注)。仅仅这一下，黑客就能阻止你连上因特网。

Man in the Middle

中间人攻击

A hacker can exploit ARP Cache Poisoning to intercept network traffic between two devices in your network. For instance, let's say the hacker wants to see all the traffic between your computer, 192.168.0.12, and your Internet router, 192.168.0.1. The hacker begins by sending a malicious ARP "reply" (for which there was no previous request) to your router, associating his computer's MAC address with 192.168.0.12 (see Diagram 3).

黑客利用ARP缓存中毒来截获你的局域网中两台设备之间的网络信息。例如，我们假象黑客想要窃听你的计算机，192.168.0.12，和你的网络路由器 (即网关，译者注) ，192.168.0.1，之间的通信信息。黑客先发送一个恶意的ARP “响应” ( 因为在此之前根本没有请求) 到你的路由器，将他的计算机的MAC地址和192.168.0.12绑定 (如图3).

Now your router thinks the hacker's computer is your computer.

       现在你的路由器以为这个黑客的计算机就是你的计算机了。

Next, the hacker sends a malicious ARP reply to your computer, associating his MAC Address with 192.168.0.1 (see Diagram 4).

       然后，黑客在发送一个恶意的ARP响应到你的计算机，将他的MAC地址和192.168.0.1绑定起来。(如图4).

Now your machine thinks the hacker's computer is your router.

       现在你的机器以为黑客的计算机是你的路由器了。

Finally, the hacker turns on an operating system feature called IP forwarding. This feature enables the hacker's machine to forward any network traffic it receives from your computer to the router (shown in Diagram 5).

       最后，黑客开启一个叫IP转发的系统功能。这个功能让黑客能将所有来自你的计算机的网络信息转发到路由器 (如图5).

Now, whenever you try to go to the Internet, your computer sends the network traffic to the hacker's machine, which it then forwards to the real router. Since the hacker is still forwarding your traffic to the Internet router, you remain unaware that he is intercepting all your network traffic and perhaps also sniffing your clear text passwords or hijacking your secured Internet sessions.

       现在，只要你尝试上网，你的计算机就会将网络信息发送到黑客的机器上，然后黑客再将其转发到路由器。由于黑客仍然将你的信息转发到网络路由器，所以你并不会察觉到他已经截获了所有你的网络信息，或许还窃听了你的明文密码或者劫持了你曾经安全的网络会话。

MAC Flooding

MAC洪泛

MAC Flooding is an ARP Cache Poisoning technique aimed at network switches. (If you need a reminder about the difference between a hub and a switch, see this sidebar.) When certain switches are overloaded they often drop into a "hub" mode. In "hub" mode, the switch is too busy to enforce its port security features and just broadcasts all network traffic to every computer in your network. By flooding a switch's ARP table with a ton of spoofed ARP replies, a hacker can overload many vendor's switches and then packet sniff your network while the switch is in "hub" mode.

       MAC洪泛是一种旨在网络交换机的ARP缓存中毒技术。当这些交换机流量超载时它们常常进入到 “集线器” 模式。在 “集线器” 模式中，交换机由于太过繁忙而不能执行它的端口安全检测功能，而是仅仅向网络中的每一台计算机广播所有的网络数据。利用大量的假冒ARP响应数据包去洪泛一台交换机的ARP映射表，黑客能使大多数制造商的交换机超载，然后当交换机进入 “集线器” 模式时，就可以发送 (恶意的) 包去嗅探你的局域网。

                                   Scared? Good, Now Calm Down!

                                  害怕了？好，现在冷静下来！

This is scary stuff. ARP Cache Poisoning is trivial to exploit yet it can result in very significant network compromise. However, before you jump to Defcon-7, notice the major mitigating factor: only local attackers can exploit ARP's insecurities. A hacker would need either physical access to your network, or control of a machine on your local network, in order to deliver an ARP Cache Poisoning attack. ARP's insecurities can't be exploited remotely.

      这是可怕的东西。ARP缓存中毒能够利用一些微不足道的手段却造成网络的巨大危害。但是，当你进入到高度戒备状态时，注意到一个重要的缓解因素：只有也在局域网中的攻击者才能利用ARP的缺陷 (因为ARP协议只会在局域网(子网)中进行) 。黑客他要不是在你的网络中找个接口插入而连接上你的局域网，要不就是控制一个局域网内的机器，这样才能进行ARP缓存中毒攻击。ARP的缺陷不能在被远程利用。

That said, hackers have been known to gain local access to networks. Good network administrators should be aware of ARP Cache Poisoning techniques.

      那就是说,黑客会被知道他接入了这个网络。优秀的网络管理员应该能意识到ARP缓存中的技术。

Since ARP Cache Poisoning results from a lack of security in a protocol that is required for TCP/IP networking to function, you can't fix it. But you can help prevent ARP attacks using the following techniques.

      由于ARP缓存中毒源于一个协议的缺陷，但是这个协议对于TCP/IP网络的运转又是必须的，你不能去修改它。但是你可以运用以下技术来防止ARP攻击。

For Small Networks

面向小型网络

If you manage a small network, you might try using static IP addresses and static ARP tables. Using CLI commands, such as "ipconfig /all" in Windows or "ifconfig" in 'NIX, you can learn the IP address and MAC address of every device in your network. Then using the "arp -s" command, you can add static ARP entries for all your known devices. "Static" means unchanging; this prevents hackers from adding spoofed ARP entries for devices in your network. You can even create a login script that would add these static entries to your PCs as they boot.

      如果你管理着一个小型网络，你或许可以试试使用静态IP地址和静态ARP映射表。用命令行输入，比如在Windows中是 “ipconfig/all” ，在NIX中是 “ifconfig” ，你就可以查看在你的网络中的所有设备的IP地址和MAC地址了。然后使用 "arp-s" 命令，你可以为你所知道的设备添加静态ARP映射。“静态” 就是不会变化；这可以防止黑客的欺骗ARP进入你的网络设备中。你甚至可以创建一个登录脚本当它们启动时自动添加这些静态ARP到你的计算机中。

However, static ARP entries are hard to maintain; impossible in large networks. That's because every device you add to your network has to be manually added to your ARP script or entered into each machine's ARP table. But if you manage fewer than two dozen devices, this technique might work for you.

       然而，静态ARP很难被维护；在大型网络中更是不可能。那是因为你每加入一台设备到你的网络中都需要你手动地编写ARP脚本或输入每台设备的ARP映射表。但是如果你是管理一个少于两打的设备，这个技术或许适合于你。

For Large Networks

面向大型网络

If you manage a large network, research your network switch's "Port Security" features. One "Port Security" feature lets you force your switch to allow only one MAC address for each physical port on the switch. This feature prevents hackers from changing the MAC address of their machine or from trying to map more than one MAC address to their machine. It can often help prevent ARP-based Man-in-the-Middle attacks.

       如果你是管理着一个大型网络，好好去研究一下你的网络交换机的 “端口安全” 功能。有一个 “端口安全” 功能是允许你强制使你的交换机在每个端口只允许 (IP地址对应的) 一个MAC地址通过。这个功能会阻止黑客改变他机器的MAC地址或试图映射多个MAC地址到他的机器上。这种技术常常用于帮助防御基于ARP的中间人攻击。

For All Networks

面向所有网络　　

Your best defense is understanding ARP Poisoning and monitoring for it. I'd highly recommend deploying an ARP monitoring tool, such as ARPwatch, to alert you when unusual ARP communication occurs. This kind of vigilance is still the greatest weapon against all kinds of attack -- for, as Robert Louis Stevenson wrote, "The cruelest lies are often told in silence."

       　　你最好的防御方法就是掌握ARP中毒的机制并监视它。我强烈建议安装一个ARP监视工具，比如ARPwatch，当有不正常的ARP通信时它会提醒你。这种警惕也是对付所有类型攻击的最有力武器——就如Robert Louis Stevenson所写的，“最残酷的谎言常常是悄无声息地说出来的”。