CAPEC-697: DHCP Spoofing
Description
An adversary masquerades as a legitimate Dynamic Host Configuration Protocol (DHCP) server by spoofing DHCP traffic, with the goal of redirecting network traffic or denying service to DHCP.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Engage in Deceptive Interactions
Prerequisites
- The adversary must have access to a machine within the target LAN which can send DHCP offers to the target.
Skills required
- MediumThe adversary must identify potential targets for DHCP Spoofing and craft network configurations to obtain the desired results.
Consequences
- ConfidentialityAccess Control
Read Data
- IntegrityAccess Control
Modify Data; Execute Unauthorized Commands
- Availability
Resource Consumption
Mitigations
- Design: MAC-Forced Forwarding
- Implementation: Port Security and DHCP snooping
- Implementation: Network-based Intrusion Detection Systems
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-CAAConnection Attempt Analysis1 shared
- D3-APCAApplication Protocol Command Analysis1 shared
- D3-CSPPClient-server Payload Profiling1 shared
- D3-NTCDNetwork Traffic Community Deviation1 shared
- D3-NTFNetwork Traffic Filtering1 shared
- D3-NTSANetwork Traffic Signature Analysis1 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis1 shared
- D3-PMADProtocol Metadata Anomaly Detection1 shared
- D3-RTSDRemote Terminal Session Detection1 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis1 shared