Arp Spoofing in Actix with Hmac Signatures

Arp Spoofing is a Layer 2 attack where an adversary sends falsified ARP messages to associate their MAC address with the IP of a legitimate host, such as an API server behind an Actix web service. In an Actix-based Rust API, this attack does not exploit Actix itself, but it subverts the trust boundary that Hmac Signatures are meant to provide. When an API endpoint relies on Hmac Signatures for request authentication, the integrity of each request is typically verified by validating a signature computed with a shared secret. If an attacker conducts Arp Spoofing on the network segment where the Actix service operates, they can intercept and observe legitimate signed requests as they transit between clients and the server.

The vulnerability arises because Hmac Signatures protect integrity and origin at the application layer, but they do not inherently prevent an on-path attacker from seeing and replaying valid messages within the time window allowed by any nonce or timestamp. An attacker who has successfully spoofed ARP frames can sit in the middle (man-in-the-middle) and capture a signed request that includes method, path, headers, and payload along with its Hmac signature. Because the signature is valid and the Actix server verifies it using the shared secret, the server may process the intercepted request as legitimate if replay controls are weak or absent. This is especially relevant when Actix endpoints do not enforce strict replay protection, use predictable nonces, or allow a relatively large clock skew for timestamp validation.

Moreover, if the Actix service uses HTTP rather than TLS-terminated HTTPS, Arp Spoofing becomes significantly easier, as the attacker can directly observe and modify cleartext traffic. Even when TLS is used, a compromised host or a malicious insider on the same network can sometimes force cleartext fallbacks or exploit misconfigured certificate validation in client-side code, allowing the attacker to intercept the Hmac-signed payloads. The server-side Actix logic that verifies signatures must therefore assume that observed, valid signatures can be replayed unless additional mitigations such as one-time nonces, strict timestamp windows, and secure transport are consistently applied.

To reduce the risk posed by Arp Spoofing when using Hmac Signatures in Actix, implement strong replay protections and ensure strict verification practices. Below are concrete code examples that demonstrate how to structure Hmac verification in Actix and how to mitigate replay attacks using timestamps and nonce tracking.

Basic Hmac Signature Verification in Actix

Use a constant-time comparison to validate the Hmac signature and ensure the request body and selected headers are included in the signing string. This example shows a handler that extracts a signature from headers and verifies it before processing the request.

use actix_web::{web, HttpRequest, HttpResponse, Result};
use hmac::{Hmac, Mac};
use sha2::Sha256;
use std::time::{SystemTime, UNIX_EPOCH};

type HmacSha256 = Hmac;

async fn verify_hmac(
    req: &HttpRequest,
    body: &[u8],
    secret: &[u8],
) -> Result {
    let signature_header = req.headers().get("X-API-Signature")
        .and_convert::()
        .ok_or_else(|| actix_web::error::ErrorBadRequest("Missing signature"))?;
    let timestamp = req.headers().get("X-Request-Timestamp")
        .and_convert::()
        .ok_or_else(|| actix_web::error::ErrorBadRequest("Missing timestamp"))?;
    // Prevent replay by checking timestamp window (e.g., 5 minutes)
    let now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs();
    let req_time = timestamp.parse::().map_err(|_| actix_web::error::ErrorBadRequest("Invalid timestamp"))?;
    if req_time + 300 < now || req_time > now + 60 {
        return Ok(false);
    }
    let mut mac = HmacSha256::new_from_slice(secret)
        .map_err(|_| actix_web::error::ErrorInternalServerError("Hmac init error"))?;
    // Include method, path, and body in the signed string
    mac.update(req.method().as_str().as_bytes());
    mac.update(req.path().as_bytes());
    mac.update(body);
    let computed = mac.finalize();
    let computed_bytes = computed.into_bytes();
    let received = hex::decode(signature_header).map_err(|_| actix_web::error::ErrorBadRequest("Invalid signature encoding"))?;
    // Constant-time comparison to avoid timing attacks
    let ok = subtle::ConstantTimeEq::ct_eq(&computed_bytes[..], &received[..]);
    Ok(ok.into())
}

async fn protected_handler(req: HttpRequest, body: web::Bytes) -> Result {
    let secret = std::env::var("HMAC_SECRET").unwrap_or_else(|_| "dev-secret-change-in-prod".into()).into_bytes();
    match verify_hmac(&req, &body, &secret).await {
        Ok(true) => Ok(HttpResponse::Ok().body("Authorized")),
        Ok(false) => Ok(HttpResponse::Forbidden().body("Invalid signature or replay detected")),
        Err(e) => Err(e),
    }
}

Replay Protection with Nonce Tracking

To further mitigate replay attacks enabled by Arp Spoofing, maintain a short-lived store of recently seen nonces. Include a unique nonce in each signed request and reject duplicates within the validity window.

use actix_web::dev::ServiceRequest;
use std::collections::HashSet;
use std::sync::{Arc, Mutex};

struct NonceCache {
    seen: Mutex>,
}

impl NonceCache {
    fn new() -> Arc {
        Arc::new(Self { seen: Mutex::new(HashSet::new()) })
    }

    fn is_replay(&self, nonce: &str) -> bool {
        let mut set = self.seen.lock().unwrap();
        if set.contains(nonce) {
            true
        } else {
            set.insert(nonce.to_string());
            false
        }
    }
}

// In your Actix app data:
// let nonce_cache = NonceCache::new();
// req.app_data::>().unwrap().is_replay(nonce)

Transport and Operational Hardening

Ensure all Actix endpoints are served over HTTPS and enforce HSTS to reduce the feasibility of cleartext interception via Arp Spoofing. Rotate Hmac secrets periodically and prefer keys with sufficient entropy. Combine Hmac verification with IP allowlisting where appropriate for defense-in-depth, and validate that timestamps are within a tight window to limit replay scope.