So I've been thinking lately about MiTM attacks because of some automation scripts I've looked at, and came to the following conclusion: If automation can help the attackers, it can also help the victims.
By comparing the current gateway MAC against a known clean MAC, and by intercepting all broadcasted ARP replies, without using static ARP tables any given victim should still be able prevent all MiTM attacks simply by resetting his arp cache with known clean values.
I don't want the user to be stuck with static arp because 1) That means his computer is not network portable, which would suck for laptops. 2) ICMP blasts can get rid of 'em, so they aren't foolproof anyway.
I want a program that'll initially query the arp table, save known clean gateway MAC values for a given network, and compare every x seconds. It'll will have a different profile for every network the user uses.
If the MAC has changed, then alert the user, and either revert to the old MAC, send an arp request based on the old MAC to search for a legit ICMP redirect/host unreachable, or just warn user that the traffic might be unsecure, depending on user input/options. Also, if the standard arpspoof broadcast packet is detected, alert the user and follow the above steps.
I want this to be an open source utility for any user with a simple gui for non-tech-savvy users. It should also be portable from windows to linux and v/v.
I know how to program in .NET with a little c mixed in. I wouldn't even begin to know how to write this program. I'd love to put in the effort but I can't do it alone, and need the community's help.
This'll be open source so anyone seeking reimbursement should stay away.
Someone to design modules/functions and say what should go in to each module/function. (ARP cache querying, comparison function, warning function, ARP cache resetting, etc...)
Someone to help write the network API's to search for broadcasted ARP replies, ICMP packets, etc...
Someone to help write system-portable code.
Someone to design a user-friendly GUI.
Someone to decide on profile storage procedures.
-->> Someone to tell me if I've missed something <<--
NOTE: Just because I say "Someone" does not mean that it won't be me doing the work. It just means that if someone if willing to put in the initiative to do it himself, I'd be incredibly appreciative.
I created a project on google here https://code.google.com/p/arp-protector/, but there is nothing currently there.
Please feel free to contact me directly with ideas or offers, if you do not want to reply to this post for whatever reason.