# PrECast: An Efficient Crypto-Free Solution for Broadcast-Based Attacks in IPv4 Networks
## 2 Taxonomy of Broadcast-Related Problems in IPv4 Networks
### Attacks from an Internal Network  
In this class of attacks, an attacker has a strong motivation of becoming a MITM to sniff for valuable corporate information. He/she may then transmit sensitive internal data using the side-channel to an external network. The Address Resolution Protocol (ARP) [1] is a well-known protocol that uses IP broadcast service within a LAN. ARP is a communication protocol used for resolving a network layer address (e.g., IPv4 address) to a link layer address (e.g., Ethernet address). This has a critical role in the Internet protocol (Version 4) suite. The ARP is a request and response protocol, the messages of which are encapsulated by a link layer protocol. It is communicated within the boundaries of a single local area network and never routed across Layer-3 IP subnets. In the absence of a destination-based authentication scheme in the ARP protocol, any malicious host may pretend to be a destination host and unicast its own MAC address. Here, the attacker will convince other network users to dynamically associate the victim's IP address with the attacker's MAC address. By doing so, the attacker will become a MITM. He/she can then attract victim's Layer-3 traffic towards him/her. This attack is popularly known as the ARP-poisoning or ARP-spoofing attack. ARP-spoofing may allow an attacker to intercept data frames on a network, modify the traffic or stop all the traffic. Thus, an attacker can breach the confidentiality and integrity of messages. This attack can only be used on networks that use ARP and is thus limited to local area network segments. The ARP-poison attack is a precursor to a plethora of LAN attacks in a network. In ARP-poisoning attacks, the victims are usually the default gateway for the network, DHCP servers, proxy servers or any other important hosts in the network. Through ARP-poisoning, an attacker can launch the following attacks:  
* Gateway and proxy hijacking
* SSL-intercept attack
* DoS attack
* DNS hijacking
* DHCP hijacking  
If the ARP-poison victim is the default-gateway or the proxy server of the network, the attacker can attract all IP traffic of the entire network towards him/her. He/she can then look for all valuable information in the network. According to the Calyptix report [11], the SSL-intercept attack constituted 11% of the overall Internet attacks in 2016. If an attacker can divert all the IP traffic towards him/her, he/she can then create an SSL-intercept to obtain all sensitive data from the network users. Through ARP-poisoning, the attacker can launch a DoS attack through the following ways:  
* By dropping all packets. * The attacker can issue a random TCP-RST (TCP-Reset [1]) command to an already existing TCP connection. * Forwarding packets to the wrong destination. DNS hijacking is a growing threat [10]. Domain Name System (DNS) hijacking intercepts legitimate DNS requests from the user and matches them to compromised IP addresses hosted on the attacker's servers. To perform DNS hijacking, an attacker launches an MITM attack, which subverts the users' DNS requests and directs them to their own compromised DNS server. The attackers' compromised DNS server uses a DNS switching Trojan to attach the wrong IP address to the user's DNS request, therefore directing him/her to a spoofed website. This attack is popularly known as pharming and could be employed by scammers in a phishing campaign aimed at stealing personal information. Interestingly, legitimate ISP providers also engage in the ill-fetingactivity to suit their own selfish interests, including placing ads or collecting statistics for big data analysis [10]. By hijacking a DHCP server, an attacker can create a rogue DHCP server. A rogue DHCP server is a DHCP server on a network that is not under the administrative control of the network staff. Through rogue DHCP address leasing, the attacker can offer a compromised gateway address. He/she can also direct all DNS queries to an external compromised DNS server or to one set by the attacker.