Environment
- Carbon Black Cloud: All Supported Versions
Question
How does CBC protect/detect against ARP spoofing/poisoning?
Answer
- CBC does not detect/protect against ARP spoofing/poisoning. However it can detect malware which is deployed to do such activity based on reputation.
- ARP spoofing is usually deployed on one endpoint in order to attack other endpoints. If there's a CB sensor on the attack endpoint, it can detect the malware doing the ARP spoofing. But the CB sensors on the targeted/receiving endpoints, which are having their traffic intercepted by the ARP spoofing host, are not going to know anything is wrong.
- If ARP spoofing has been conducted on the Network level, it cannot be detected. It is advised to use high level of encryption when transmitting data, so that attacker cannot intercept it.
Additional Notes
Related Content
