MAC Spoofing. 1
Oleg Petukhov, lawyer in the field of international law and personal data protection, information security specialist security, protection of information and personal data.
Telegram channel: https://t.me/protectioninformation
Telegram Group: https://t.me/informationprotection1
Website: https://legascom.ru
Email: online@legascom.ru
#informationprotection #informationsecurity
This type of attack is implemented by forging a MAC address, for example, an attacker can forge a MAC address that was used by another network host. An attacker can use this attack to collect confidential information.
To implement this attack, as in the previous examples, you can use the macchanger utility.
root@kali : # macchanger –r сетевой_адаптер
As a result, the MAC address of the specified network adapter will be set to a random value.
root@kali : # macchanger – mac=xx:xx:xx:xx:xx:xx сетевой_адаптер
In this case, the MAC address will be changed to the desired value.
In order to prevent this type of attack, it is necessary to follow the measures described earlier in the section on overflowing the SELF-table, that is, you need to specify the maximum number of MAC addresses on the port, specify the action that will be performed in case of violation of our policy.
To specify a static MAC address in interface configuration mode, run:
Switch (config-if)# switchport port-security mac-address 4321.4321.fa12
where 4321.4321.fa12 is the MAC address of the client.
Switch# conf t
Switch(config)# int range f0/1-24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport port-security
Switch(config-if-range)# switchport port-security violation shutdown
Switch(config-if-range)# switchport port-security maximum 3
Switch(config-if-range)# arp timeout 60
And this example is similar to the example from the SELF-table overflow section, but an ARP timeout is added here, that is, if more than three devices connect to one within 60 seconds, the port will be disabled.
