How to thwart rogue DHCP server malware

By Sherri Davidoff | Jul 3, 2009

0 comments

Facebook

LinkedIn

Digg

Recently there have been reports of "rogue DHCP server" malware -- trojans that automatically install their own DHCP servers on your network and compete with your legitimate server. Using rogue DHCP servers, attackers can intercept and redirect traffic from any device that uses the Dynamic Host Configuration Protocol (DHCP) -- workstations, printers, laptops, copiers and more.

The Dynamic Host Configuration Protocol was developed in the early 1990s to ease network maintenance and setup, and it has always had fundamental security vulnerabilities. Fortunately, there are time-tested solutions you can use to detect and defend against rogue DHCP server malware.

When a DHCP-enabled client (for example, a laptop) connects to the network, it sends out a broadcast message searching for the DHCP server. The local DHCP server responds with a proposed IP address assignment for your laptop, and eventually other local configuration information, such as the DNS server IP address and gateway IP address. Once the negotiation is complete, the laptop can configure itself and talk to others on the IP network.

Thanks to DHCP, a mobile device can go from a wireless hotspot to a home network to a corporate network, all without ever having to manually change its IP address settings. Large enterprises can deploy and redeploy hundreds or thousands of servers without ever manually changing individual network configuration settings.

DHCP security concerns
DHCP, however, had known security issues since it was invented. The original DHCP specification, dating back to 1993, has a section called "Security Considerations," which reads:

"...DHCP in its current form is quite insecure. Unauthorized DHCP servers may be easily set up. Such servers can then send false and potentially disruptive information to clients such as incorrect or duplicate IP addresses, incorrect routing information (including spoof routers, etc.), incorrect domain nameserver addresses (such as spoof nameservers), and so on."

0 comments

Facebook

LinkedIn

Digg