MAC Spoofing Research Articles

Implementation of Penetration Testing Tools to Test Wi-Fi Security Levels at the Directorate of Innovation and Business Incubators

Wi-Fi networks have become a critical infrastructure in many organisations, including the Directorate of Innovation and Business Incubator. However, potential vulnerabilities in Wi-Fi networks also increase as technology advances. Therefore, testing is needed to identify and address security that can harm network users. This research aims to implement penetration testing tools in testing the security level of Wi-Fi networks at the Directorate of Innovation and Business Incubator. The penetration testing method is used to test security and assess the level of resistance to attacks on Wi-Fi in the form of simulated attacks. One of the operating systems that provides penetration testing tools that meet the needs of testing is linux times. The tools used in the penetration testing process are airmon-ng, airodump-ng, aireplay-ng, aircrack-ng, macchanger, ettercap and wireshark. The results showed that the Wi-Fi security of the Directorate of Innovation and Business Incubator still needs to be improved where the results of the four types of attacks only one failed, namely MAC Spoofing. In addition, the tests on Denial of Service, Cracking the Encryption, and Man-in-the-Middle attacks were successful. The application of anticipation by increasing Wi-Fi security based on the attacks that have been carried out can prevent these attacks.

Computer Network: An Implementation of MAC Spoofing

An exponential growth has observed of network or internet users due to diverse resource and information sharing services. Contrary, network uses also increased in different kinds of attacks. Means network is vulnerable for many types of attacks. Computer network may exploit in different contexts such as denial of service, ping death, malfunction routing, flooding, man in the middle and spoofing attack. Among of these MAC spoofing is kind of attack spoofing attack that target to MAC or physical address of the network host or router. It tampers original address to any other random or user defined address. The aim of the study is to present MAC address and its types. With this, MAC spoofing attack also presented. Implementation environment and method for the MAC spoofing also presented. MAC spoofing is implemented in the KALI Linux operating system with the help of MACCHANGER tool.

A channel state information based virtual MAC spoofing detector

Physical layer security has attracted lots of attention with the expansion of wireless devices to the edge networks in recent years. Due to limited authentication mechanisms, MAC spoofing attack, also known as the identity attack, threatens wireless systems. In this paper, we study a new type of MAC spoofing attack, the virtual MAC spoofing attack, in a tight environment with strong spatial similarities, which can create multiple counterfeits entities powered by the virtualization technologies to interrupt regular services. We develop a system to effectively detect such virtual MAC spoofing attacks via the deep learning method as a countermeasure. A deep convolutional neural network is constructed to analyze signal level information extracted from Channel State Information (CSI) between the communication peers to provide additional authentication protection at the physical layer. A significant merit of the proposed detection system is that this system can distinguish two different devices even at the same location, which was not well addressed by the existing approaches. Our extensive experimental results demonstrate the effectiveness of the system with an average detection accuracy of 95%, even when devices are co-located.

Design and analysis of data link impersonation attack for wired LAN application layer services

Impersonation attack, also known as MAC spoofing, is widespread in wireless local area networks. Under this attack, the senders cannot control the device that listens to their traffic. On the other hand, the physical layer of the wired local area network is more secure, where the traffic is transmitted through cables and network nodes to the intended receivers. Each network node builds its MAC address table, which states stations that are physically connected (directly or indirectly) to each port, so traffic encryption is an unnecessary process. This paper discusses the design and testing of a new attack called a data link impersonation attack. In this attack, the attacker is considered a hardware intruder that deceives data link layer apparatus like the switches of layer two or three, taking advantage of a vulnerability in the MAC address table of the network nodes. That leads the network switches to send all the network traffic to the intruder instead of the real network device (usually a network service provider under attack). Intruder accepts all incoming requests/traffic from the service requester. If the intruder does not reply to the received requests sent by service requesters, it acts as a black hole intruder, simply causing a denial-of-service attack. If an intruder responds to these requests with fake replies to steal information from service requesters, it acts as a white hole intruder. During the attack, the intruder is transparent for the whole network and does not affect overall network performance and generally the network services, so it is so hard to be discovered by the network software running the network apparatus. Different scenarios were tested using different network simulators and physical networks (CISCO L2/L3 switches). It is demonstrated that the attacker is successfully denied the service/application under attack. The proposed attack reveals the new vulnerability of the wired local area network and opens the door for network scientists to enhance network software that runs the network apparatus immune against the proposed attack.

Cloud-Based Zero Trust Access Control Policy: An Approach to Support Work-From-Home Driven by COVID-19 Pandemic.

The ubiquitous cloud computing services provide a new paradigm to the work-from-home environment adopted by the enterprise in the unprecedented crisis of the COVID-19 outbreak. However, the change in work culture would also increase the chances of the cybersecurity attack, MAC spoofing attack, and DDoS/DoS attack due to the divergent incoming traffic from the untrusted network for accessing the enterprise’s resources. Networks are usually unable to detect spoofing if the intruder already forges the host’s MAC address. However, the techniques used in the existing researches mistakenly classify the malicious host as the legitimate one. This paper proposes a novel access control policy based on a zero-trust network by explicitly restricting the incoming network traffic to substantiate MAC spoofing attacks in the software-defined network (SDN) paradigm of cloud computing. The multiplicative increase and additive decrease algorithm helps to detect the advanced MAC spoofing attack before penetrating the SDN-based cloud resources. Based on the proposed approach, a dynamic threshold is assigned to the incoming port number. The self-learning feature of the threshold stamping helps to rectify a legitimate user’s traffic before classifying it to the attacker. Finally, the mathematical and experimental results exhibit high accuracy and detection rate than the existing methodologies. The novelty of this approach strengthens the security of the SDN paradigm of cloud resources by redefining conventional access control policy.

AEGIS: Detection and Mitigation of TCP SYN Flood on SDN Controller

Software-Defined Network (SDN) segregates the control plane and the data plane to bring about a programmable network. The controller at the control plane runs network modules and sets rules for forwarding the packets in the switches that resides at the data plane. Though advantageous in several ways, SDN can fail when the controller is saturated by a flood of TCP SYN packets. SYN flood can be created using malicious spoofing of IP or MAC addresses or flash crowd. The existing solutions to mitigate SYN flood against the controller does not adequately handle MAC spoofing based SYN flood, and these are unable to distinguish between flash crowd and malicious traffic. To overcome some limitations in existing solutions, we propose a novel mechanism called AEGIS , which detect and mitigate SYN flood against the controller in SDN. AEGIS runs in the controller, and it regularly checks if there is a performance lag in the controller due to an ongoing SYN flood. If a performance degradation is detected, then AEGIS takes it an indication of SYN flood and it identifies whether it is due to spoofed addresses or flash crowd. Once the reason is found, the appropriate mitigation procedure is triggered. We evaluate AEGIS in testbed and emulator settings, and we compare the results of the evaluation with state-of-the-art solutions. The performance evaluation of AEGIS shows that it identifies the malicious SYN at an accuracy of 97.78%. Moreover, when there is no SYN flood, AEGIS takes 0.0637s to set up a successful TCP connection, which is 53.81% less than the time taken by the state-of-the-art solution, thus, it proves that AEGIS is lightweight.

Detection and Mitigation of MAC Spoofing

Detection and Mitigation of MAC Spoofing

An intelligent approach for dynamic network traffic restriction using MAC address verification

Networks are spread all throughout the world, usually found in homes, organizations, governments, etc. Due to the exponential growth in the deployment of networks, this field has become a prime target for attackers. A spoofing attack is a very common type of attack on a network. It may sound simple, but it is a complex technique involving impersonation and gaining access to restricted information. Some spoofing attacks complicate scenarios by launching other attackers using spoofed computers. Networks are usually unable to identify spoofing attacks since the hackers who attack can forge the MAC address of their device to impersonate another device on the network resulting in an advanced level of ARP spoofing thereby exposing the vulnerability of the network. This becomes really tricky when the attack is done in the address of a company’s network. Several techniques exist to detect MAC spoofing such as Sequence Number Analysis, Radio Signal strength based detection, and Hop based detection. But all these techniques wrongly classify malicious user to be authenticated ones at times costing the authenticity of the valuable legitimate users. In this paper, a design of an address verification technique to detect threats by using multiplicative increase and additive decrease algorithm based on network localization with the support of Port Scanning, OS fingerprinting and Route Tracing algorithms has been discussed. This eliminates the chance of a legitimate user getting penalized during the traffic restriction resulting in a more trustworthy and a more intelligent network.

Teasers on Various Spoofing Attacks

This paper proposed to give in depth survey on types of spoofing attacks. Spoofing is a way of masquerading identity of a person or a computer by providing fake data. In this paper huge variety of spoofing methods which includes brief introduction of Dns, Ip, Email, Arp, Web, Wireless, Mac spoofing. The intention of spoofing is to manipulate, steal data which in turn results in data loss and loss on millions of dollars.

Methodologies for Network Topology Discovery and Detection of MAC and IP Spoofing Attacks

The sustained growth and innovation of information technologies, combined with the resulting complexity in communication infrastructures, has pushed the network into an increasingly critical role within organizations of all sizes. In order to assure that operations are aligned with the business needs, monitoring and management practices are gaining importance across all network domains. As a result, network managers need the best possible tools for managing the network infrastructure and assuring that it will play its essential part in supporting the organization in a reliable, predictable, efficient and cost-effective manner. This paper proposes several algorithms that will be used on an integrated network monitoring open-source tool: an algorithm for network topology discovery and two algorithms for the detection and blocking of MAC and IP spoofing network attacks. The proposed approaches are based on the SNMP protocol, which is currently supported by most network devices, and the performance tests that were made show that they are effective, reliable and very easy to deploy in real operating scenarios.

Efficient Hybrid Network (Wired and Wireless) Intrusion Detection using Statistical Data Streams and Detection of Clustered Alerts

Problem statement: Wireless LAN IEEE 802.11 protocols are growing rapidly and security has always been a concern with the security of wired network. Wireless networks encountered threats from unauthorized access to network resources, installation of access points and illegal sniffing (refer as classical intrusion threats). In its current hybrid wired and wireless network attacks on the generally distinguish from normal cable intrusion attacks, selective forwarding attacks, MAC spoofing attacks. This means that the simple traditional misuse detection and anomaly detection model alone not sufficient to identify these mixed attacks on the hybrid network (wired and wireless). Approach: Our proposed work presents a hybrid cluster-based intrusion detection statistical anomaly, for detecting selective forwarding in wireless networks and intrusion into traditional wired networks. The detection was identified by changes in the statistical characteristics of data traffic on the wireless network. The clustering of data traffic based on the characteristics of alert classes and normal classes improve the performance of our hybrid intrusion detection in both wired and wireless network efficiently. The simulation was performed to evaluate the performance of wired intrusion detection systems to the proposed wireless intrusion detection on the data traffic in the area of wired and wireless hybrid network environment. Results: The proposed wireless intrusion detection system sharply detect the statistical change point detection of intrusion behavior in terms of attack rate and throughput of data traffic. The probability of intrusion attack and detection delay were measured in the simulation scenario, the result is 17% better than the current part of the exiting wired intrusion detection. Conclusion: The proposed anomaly intrusion traffic detection scheme performs better in heterogametic hybrid network (i.e., wired and wireless) compared to that of conventional homogeneous intrusion detection network models.

Virtualizing networking and security in the cloud

Virtualization of computer workloads onto powerful x86 multicore platforms is leading to a massive transformation in the way services are produced by next generation data centers. Simultaneously, cloud computing principles are compelling a rethink in the way enterprises are beginning to consume such services. In this paper, we present the need for network and security (netsec) functions, which are currently realized in hardware appliances, to significantly evolve to keep pace with these new trends, and to provide "disruptively simplified" security that was not earlier possible With server consolidation and desktop virtualization, significantly more traffic remains within the data center racks, leading to blind spots for "in network" security appliances. Current netsec devices which are architected based on "scale up" principles cannot keep pace with increased bandwidth driven to the servers, and the ever increasing volume of threats at all layers of the network stack. Also, highly mobile workloads and increasing intelligence in the virtual/hypervisor layer, makes it increasingly hard for static network devices to interlock with dynamic policy changes and onthe- fly re-purposing of resources to serve different workloads, applications, or users This paper highlights a new trend in the industry to virtualize netsec functions inside security virtual appliances (SVAs), which can then be placed on hosts, and offer distributed security functions for network flows across the cluster. We analyze this trend in detail using the VMware vShield product line as an example. The approach replaces single choke-point based physical security devices like firewalls, IP address Management (IPAM), flow monitoring, and data leakage prevention (DLP) with distributed virtual counterparts running on slices of x86 co-located with compute workloads with ability to tap into traffic going in and out of virtual machines (VMs) vShield's distributed scale-out architecture means performance can scale up or down linearly as new SVAs are added, while simplifying the lifecycle management of these SVAs including installs, upgrades, ability to debug, and reliability by leveraging underlying virtualization primitives of VM cloning, deploy from template, and VM high availability and fault tolerance. Interactions with features like live migration (vmotion) of guest VMs and distributed power management of host servers introduce new aspects of appliance management that was not possible in the physical world. The paper analyzes these aspects of SVA management in depth. Our measurements of the security inspection throughput for given vCPUs and memory indicate it is comparable to those of physical counterparts with the additional flexibility of a scale-out deployment. Further, we demonstrate that with this approach a virtual datacenter (VDC) in the cloud can be deployed in minutes compared to days/weeks with physical datacenters. Finally, we present the additional security inspections that can be performed in the virtual world that were not possible in the physical world. The ability of SVAs to introspect traffic into and out of VMs implies they can perform checks for MAC spoofing, IP spoofing [6], ARP filtering at the source. Furthermore, based on security analysis if a VM is deemed suspect it can be quickly quarantined Concepts such as flow introspection, automated insertion of SVAs into flows at VM ingress/egress, distributed scale out architecture across a cluster of hosts, encapsulation of secure VDCs, and programmability of security policies via RESTful interfaces, represent a significant architectural change, with wide applicability in enterprise data centers, and private/public cloud environments.

Enhancement of Passive MAC Spoofing Detection Techniques

Failure of addressing all IEEE 802.11i Robust Security Networks (RSNs) vulnerabilities enforces many researchers to revise robust and reliable Wireless Intrusion Detection Techniques (WIDTs). In this paper we propose an algorithm to enhance the performance of the correlation of two WIDTs in detecting MAC spoofing Denial of Service (DoS) attacks. The two techniques are the Received Signal Strength Detection Technique (RSSDT) and Round Trip Time Detection Technique (RTTDT). Two sets of experiments were done to evaluate the proposed algorithm. Absence of any false negatives and low number of false positives in all experiments demonstrated the effectiveness of these techniques.