|
Posted by Juergen P. Meier on November 6, 2005, 10:39 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Multi-Language Hierarchy crossposting. Please feel free to fup in the
language and hierarchy you prefer.
> I want to build up a resource containing all possibilities to defend ARP
> spoofing. As I think ARP spoofing is one of the most powerful, easiest
> and underestimated attacks I want to know all your tricks, patches,
> anything that you know/apply to defend ARP spoofing.
The very best defense against ARP spoofing is to make sure your
network design and security concept does not rely on MAC addresses for
any of the following: Authentication, Authorisation, Identification.
> I know the standard things to do (like static ARP entries and so on),
Apparently not. The standard thing to do is to make your
network design (and security concept) immune to this kind of threat.
> what I want to know from you is something like:
>
> -OS x has a patch y which helps preventing ARP spoofing (like antidote)
> or
What makes you think the bad guy would install such a patch? How would
you enforce installation? How can you enforce that only stations with
such a patch participate in your network?
> -OS x in version y has a small built in ARP prevention (like SunOS)
> or
What are your talking about?
> -Firewall/IDS x is able to prevent/detect ARP spoofing
Unlikely if the spoofing entity has any brains at all. (i.e. you can
only catch complete dorks this way ;)
> Also welcome are new thoughts about ARP spoofing prevention (like S-ARP
> or Secure Link Layer).
Simply seperate your Authentication and Authorisation from Ethernet
layer parameters. This has been the way to make yourself immune against
ARP spoofing attacks for decades now. IPSEC is one of the many
technical solutions to accomplish this goal.
> Give me all your information, tricks and tips, so I can build up a
> complete resource.
Give me all your money, bonds and deeds, so I can provide you with a
complete response ;-)
Juergen
--
Juergen P. Meier - "This World is about to be Destroyed!"
end
If you think technology can solve your problems you don't understand
technology and you don't understand your problems. (Bruce Schneier)
| 
XML site map