A network analyst is investigating compromised corporate information. The analyst leads to a theory that network traffic was intercepted before being transmitted to the internet. The following output was captured on an internal host:
IPv4 Address ............ 10.0.0.87
Subnet Mask ............. 255.255.255.0
Default Gateway ......... 10.0.0.1
Internet Address Physical Address
10.10.255.255 ff-ff-ff-ff-ff-ff
10.0.0.1 aa-aa-aa-aa-aa-aa
10.0.0.254 aa-aa-aa-aa-aa-aa
244.0.0.2 01-00-5e-00-00-02
Based on the IoCs, which of the following was the most likely attack used to compromise the network communication?
Correct Answer: B
ARP poisoning is a type of attack that modifies the ARP cache on a network device. The ARP cache is a table that stores the IP addresses and MAC addresses of other devices on the network. When a device needs to send a packet to another device, it looks up the MAC address of the destination device in its ARP cache. If the MAC address is not in the cache, the device sends an ARP request to the destination device. The destination device responds to the ARP request with its MAC address.
In ARP poisoning, the attacker sends spoofed ARP messages to the victim device. The spoofed ARP messages contain the attacker's MAC address as the source MAC address and the victim's IP address as the destination IP address. When the victim device receives the spoofed ARP messages, it updates its ARP cache to associate the attacker's MAC address with the victim's IP address.
Now, when the victim device needs to send a packet to another device, it will use the attacker's MAC address as the destination MAC address. The attacker can then intercept the packet and read or modify its contents.
In the given scenario, the network analyst found that the ARP cache on the internal host was poisoned. The attacker's MAC address was associated with the victim's IP address. This means that the attacker was able to intercept network traffic from the victim device.