1 00:00:00,440 --> 00:00:08,330 Now similar to the other types of spoofing attacks, dynamic host configuration protocol Dhcp spoofing 2 00:00:08,450 --> 00:00:15,470 involves an attacker pretending to be someone else, in this case acting as a legitimate Dhcp server. 3 00:00:16,120 --> 00:00:22,210 Since Dhcp is used on most networks to provide, addressing and other common information to clients, 4 00:00:22,240 --> 00:00:25,990 losing control of this part of the network can be dangerous. 5 00:00:28,280 --> 00:00:31,730 Dynamic host configuration protocol, Dhcp. 6 00:00:32,330 --> 00:00:38,090 It's a protocol used to provide automatic and central management for the distribution of IP addresses 7 00:00:38,090 --> 00:00:39,260 within a network. 8 00:00:40,340 --> 00:00:47,570 It's also used to configure the proper subnet mask default gateway and DNS server information on the 9 00:00:47,570 --> 00:00:48,350 device. 10 00:00:49,020 --> 00:00:54,690 In most homes and small businesses, the router acts as a Dhcp server. 11 00:00:54,990 --> 00:00:59,760 In large networks, a single computer might act as a Dhcp server. 12 00:01:00,620 --> 00:01:03,590 In short, the process goes like this. 13 00:01:03,920 --> 00:01:08,090 The device the client requests an IP address from a router. 14 00:01:08,120 --> 00:01:09,020 The host. 15 00:01:09,530 --> 00:01:16,070 After which the host assigns an available IP address to allow the client to communicate on the network. 16 00:01:17,000 --> 00:01:20,360 So let's look at some of the advantages of using Dhcp. 17 00:01:21,520 --> 00:01:26,050 A computer or any other device that connects to a network, local or internet. 18 00:01:26,350 --> 00:01:30,080 Must be properly configured to communicate on that network. 19 00:01:30,100 --> 00:01:35,080 Makes sense since Dhcp allows that configuration to happen automatically. 20 00:01:35,110 --> 00:01:40,000 It's used in almost every device that connects to a network, including computers, switches, smart 21 00:01:40,000 --> 00:01:41,710 phones, gaming consoles, you name it. 22 00:01:42,900 --> 00:01:45,750 Now because of this dynamic IP address assignment. 23 00:01:46,360 --> 00:01:52,930 There's less of a chance that two devices will have the same IP address, which is very easy to run 24 00:01:52,930 --> 00:01:56,650 into when using manually assigned static IP addresses. 25 00:01:58,110 --> 00:02:05,250 Using Dhcp also makes a network much easier to manage from an administrative point of view. 26 00:02:05,280 --> 00:02:10,979 Every device on the network can get an IP address with nothing more than their default network settings, 27 00:02:10,979 --> 00:02:13,950 which is set up to obtain an address automatically. 28 00:02:13,950 --> 00:02:15,030 So that's easy. 29 00:02:15,030 --> 00:02:18,030 Gives them nothing to call the help desk about. 30 00:02:18,630 --> 00:02:24,960 The only other alternative is to manually assign addresses to each and every device on the network. 31 00:02:26,070 --> 00:02:27,870 You're not getting paid enough to do that. 32 00:02:29,280 --> 00:02:35,760 So because these devices can get an IP address automatically, they can move freely from one network 33 00:02:35,760 --> 00:02:36,600 to another. 34 00:02:36,840 --> 00:02:43,680 Given that they're all set up with Dhcp and receive an IP address automatically, which is super helpful 35 00:02:43,680 --> 00:02:44,910 with mobile devices. 36 00:02:45,780 --> 00:02:53,040 Now, as a cyber security expert, you should know one more thing about the Dhcp mechanism. 37 00:02:53,830 --> 00:02:56,920 The first device which replies to a Dhcp. 38 00:02:56,920 --> 00:03:00,580 Discover request decides the configuration of the client. 39 00:03:01,730 --> 00:03:06,380 There is not any mechanism to authenticate the Dhcp server. 40 00:03:08,310 --> 00:03:17,460 Similarly, a Dhcp server tries to reply to all the Dhcp requests and again there is no authentication 41 00:03:17,460 --> 00:03:20,910 mechanism for the clients who request an IP. 42 00:03:21,300 --> 00:03:22,110 You get it. 43 00:03:22,680 --> 00:03:23,700 I think you do. 44 00:03:23,730 --> 00:03:26,790 What if a hacker replies before the real Dhcp? 45 00:03:27,120 --> 00:03:34,230 Or what if a client sends a lot of Dhcp discovery requests by changing the Mac address each time?