MITRE ATT&CK  /  T1557.003

T1557.003

DHCP Spoofing

Description

Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows:1. The client broadcasts a `DISCOVER` message.2. The server responds with an `OFFER` message, which includes an available network address.3. The client broadcasts a `REQUEST` message, which includes the network address offered.4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters.Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHC…

Platforms

Mitigations

• M1037 — Filter Network Traffic
• M1031 — Network Intrusion Prevention

Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →