Detecting and Mitigating ARP Cache Poisoning (T1557.002)

ARP is the glue that ties IPv4 addresses to hardware addresses on a local network, and it trusts everyone. MITRE ATT&CK technique T1557.002, ARP Cache Poisoning, covers abusing that trust. The tactics are credential access and collection, and the platforms are Linux, Windows and macOS.

How attackers use it

ARP resolves IPv4 addresses to link layer addresses such as a MAC address. A device that lacks the MAC for a given IP broadcasts a request. The device that owns the IP replies with its MAC, and the requester stores the answer in its ARP cache.

MITRE describes how an adversary abuses this. They can wait passively for a request and reply with their own MAC, which makes the victim believe it is talking to the intended device. The forged reply has to beat the legitimate one. They can also send a gratuitous ARP reply that announces ownership of an IP address to every device on the segment.

The root cause is that ARP is stateless and does not require authentication, so devices may wrongly add or update an IP to MAC mapping. With the position gained, adversaries can collect or relay data such as credentials, especially data sent over insecure, unencrypted protocols.

How to detect it

MITRE lists no data sources on this page. Signals from the description:

• One MAC address claiming several IP addresses, or the default gateway's MAC changing.
• Bursts of unsolicited (gratuitous) ARP replies.
• Duplicate IP address warnings from operating systems.
• Switch features such as dynamic ARP inspection, where available, logging invalid ARP packets.
• Network intrusion detection alerts for ARP anomalies.

How to reduce the risk

MITRE lists five mitigations.

1. Encrypt sensitive information. Encrypt wired and wireless traffic, use sound authentication protocols such as Kerberos, and protect credential carrying web traffic with SSL/TLS. This makes a successful poisoning much less useful.
2. Network intrusion prevention. Use systems that identify AiTM traffic patterns.
3. User training. Teach users to be suspicious of certificate errors.
4. Disable or remove features. Consider disabling cache updates on gratuitous ARP replies.
5. Limit access to resources over the network. Create static ARP entries for networked devices. MITRE notes this may be infeasible for large networks, so use it for gateways and critical servers.

Check your own environment

# Linux or macOS: view the ARP table
arp -a

# Windows: view the ARP neighbor table
Get-NetNeighbor -AddressFamily IPv4 | Select-Object IPAddress, LinkLayerAddress, State

Look for repeated MAC addresses across different IPs, and confirm your gateway's MAC matches the device you expect.

Quick check

Sources

• MITRE ATT&CK T1557.002 ARP Cache Poisoning