Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: How does CBC protect/detect against ARP spoofing/poisoning?

Carbon Black Cloud: How does CBC protect/detect against ARP spoofing/poisoning?

Environment

  • Carbon Black Cloud: All Supported Versions

Question

How does CBC protect/detect against ARP spoofing/poisoning?

Answer

  • CBC does not detect/protect against ARP spoofing/poisoning. However it can detect malware which is deployed to do such activity based on reputation.
  • ARP spoofing is usually deployed on one endpoint in order to attack other endpoints. If there's a CB sensor on the attack endpoint, it can detect the malware doing the ARP spoofing. But the CB sensors on the targeted/receiving endpoints, which are having their traffic intercepted by the ARP spoofing host, are not going to know anything is wrong.
  • If ARP spoofing has been conducted on the Network level, it cannot be detected. It is advised to use high level of encryption when transmitting data, so that attacker cannot intercept it.



 

Additional Notes

On CBC side, we can use the following MITRE TTP's to detect and follow these attacks:
Cb Connect Sessions & Presentation Material
 

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎06-28-2022
Views:
59
Contributors