Arp Spoofing in Aspnet with Hmac Signatures

Arp spoofing is a Layer 2 network attack where an attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate host, such as a gateway or another API service. In an ASP.NET application that uses HMAC signatures to protect request integrity, arp spoofing can enable on-path manipulation of in-flight HTTP messages. Because HMAC verification typically focuses on the integrity of headers and payload (e.g., using a shared secret to sign a hash of selected request components), it does not inherently prevent an attacker from observing or modifying requests that traverse a compromised local network segment.

When an ASP.NET client computes an HMAC over a request—say, including the HTTP method, selected headers, and a timestamp—and the request traverses a network where arp spoofing is active, an adversary can intercept and relay the request. If the application’s HMAC verification logic does not enforce strict transport protections (such as requiring TLS) and does not include a nonce or replay detection tied to the client identity, the attacker could forward, delay, or replay the signed request without invalidating the signature. This is especially risky when the same HMAC key is shared across multiple clients or services, or when the signature scope is limited to headers and body but excludes critical metadata like the target host or strict channel binding.

The risk is compounded when ASP.NET applications expose unauthenticated endpoints or accept requests where the HMAC is the primary trust mechanism without additional context binding. For example, an attacker conducting arp spoofing might alter non-idempotent requests within a narrow time window if the server does not enforce one-time nonces or strict replay windows. Even when HMAC signatures validate structural integrity, they do not guarantee that the request was not intercepted or modified after signing if the underlying transport is compromised. Therefore, relying solely on HMAC signatures without robust transport security and anti-replay controls leaves the application susceptible to session hijacking, request tampering, and privilege escalation facilitated by arp spoofing.

Remediation centers on ensuring HMAC verification is bound to a secure channel and includes anti-replay and context-binding measures. Always enforce HTTPS so that ARP-layer attacks cannot trivially intercept or modify traffic. Include a nonce and timestamp in the signed string, validate freshness strictly, and scope the signature to the target host and port where possible. Below are concrete ASP.NET code examples that demonstrate these practices.

Example 1: HMAC-SHA256 request signing and verification with nonce and timestamp in ASP.NET Core

// Client: Compute HMAC over method, path, nonce, timestamp, and body
using System.Security.Cryptography;
using System.Text;

public static class HmacHelper
{
    private static readonly string SharedSecret = Environment.GetEnvironmentVariable("HMAC_SHARED_SECRET");
    public static string ComputeHash(string method, string path, string nonce, long timestamp, string body)
    {
        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(SharedSecret));
        var payload = $"{method}:{path}:{nonce}:{timestamp}:{body}";
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
        return Convert.ToBase64String(hash);
    }
}

// Usage on client side
var method = "POST";
var path = "/api/values";
var nonce = Guid.NewGuid().ToString();
var timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
var body = @"{ ""data"": ""example"" }";
var signature = HmacHelper.ComputeHash(method, path, nonce, timestamp, body);

var request = new HttpRequestMessage(new HttpMethod(method), $"https://api.example.com{path}");
request.Headers.Add("X-API-Nonce", nonce);
request.Headers.Add("X-API-Timestamp", timestamp.ToString());
request.Headers.Add("X-API-Signature", signature);
request.Content = new StringContent(body, Encoding.UTF8, "application/json");

var client = new HttpClient();
var response = await client.SendAsync(request);

// Server: ASP.NET Core middleware to verify HMAC, nonce, and timestamp
using Microsoft.AspNetCore.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

public class HmacValidationMiddleware
{
    private readonly RequestDelegate _next;
    private const int ReplayWindowSeconds = 300; // 5 minutes
    private static readonly Dictionary NonceCache = new Dictionary();

    public HmacValidationMiddleware(RequestDelegate next) => _next = next;

    public async Task Invoke(HttpContext context)
    {
        if (!context.Request.Headers.TryGetValue("X-API-Nonce", out var nonceValues) ||
            !context.Request.Headers.TryGetValue("X-API-Timestamp", out var timestampValues) ||
            !context.Request.Headers.TryGetValue("X-API-Signature", out var signatureValues))
        {
            context.Response.StatusCode = 400;
            await context.Response.WriteAsync("Missing required headers.");
            return;
        }

        var nonce = nonceValues.ToString();
        var timestampStr = timestampValues.ToString();
        var receivedSignature = signatureValues.ToString();

        if (!long.TryParse(timestampStr, out var timestamp) ||
            Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - timestamp) > ReplayWindowSeconds)
        {
            context.Response.StatusCode = 400;
            await context.Response.WriteAsync("Timestamp invalid or expired.");
            return;
        }

        // Basic nonce replay protection
        lock (NonceCache)
        {
            if (NonceCache.TryGetValue(nonce, out var seen) && seen >= timestamp)
            {
                context.Response.StatusCode = 400;
                await context.Response.WriteAsync("Nonce already used.");
                return;
            }
            NonceCache[nonce] = timestamp;
        }

        // Recompute signature using the request body and headers included by the client
        var method = context.Request.Method;
        var path = context.Request.Path;
        var body = await new StreamReader(context.Request.Body).ReadToEndAsync();
        // Reset stream for downstream middleware
        context.Request.Body.Position = 0;

        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(Environment.GetEnvironmentVariable("HMAC_SHARED_SECRET")));
        var payload = $"{method}:{path}:{nonce}:{timestamp}:{body}";
        var computed = Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(payload)));

        if (!CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(computed), Encoding.UTF8.GetBytes(receivedSignature)))
        {
            context.Response.StatusCode = 401;
            await context.Response.WriteAsync("Invalid signature.");
            return;
        }

        await _next(context);
    }
}

Example 2: Binding HMAC scope to host and port to mitigate altered routing in arp spoofing

When an attacker performs arp spoofing, they can redirect traffic to a malicious host that still presents valid TLS certificates in some configurations. Including the host and port in the signed string prevents a valid signature computed for one target from being accepted at another. In ASP.NET Core, you can incorporate the request host and port into the signature scope.

// Client: include host and port in the signature base
var host = "api.example.com";
var port = 443;
var payload = $"{method}:https://{host}:{port}{path}:{nonce}:{timestamp}:{body}";
var signature = Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(payload)));

// Server: verify host and port explicitly
var expectedHost = "api.example.com";
var expectedPort = 443;
if (context.Request.Host.Host != expectedHost || context.Request.Host.Port != expectedPort)
{
    context.Response.StatusCode = 403;
    await context.Response.WriteAsync("Forbidden host/port.");
    return;
}
// Then proceed with shared secret and payload verification as above

These examples emphasize that HMAC signatures must be combined with strict transport security, nonces, timestamps, and explicit scope binding to reduce the risk of arp spoofing and replay attacks in ASP.NET applications. Defense in depth—network controls, TLS, and precise signature semantics—remains essential.