Arp Spoofing in Chi with Dynamodb

Arp spoofing is a network-layer attack where an adversary sends falsified Address Resolution Protocol (ARP) replies to associate their MAC address with the IP address of another host, such as a DynamoDB endpoint in a Chi cluster. In Chi, nodes communicate over a distributed Erlang distribution protocol; if an attacker subverts ARP on the local network segment, traffic intended for a DynamoDB service can be redirected to the attacker’s host.

DynamoDB itself is a managed NoSQL service and does not run inside Chi, but Chi applications often rely on DynamoDB as a backend store. When a Chi node resolves a DynamoDB hostname, the initial ARP resolution can be poisoned. This exposes session tokens, query parameters, and IAM credentials that travel in clear text if TLS is not enforced, enabling session hijacking or injection of malicious query conditions. An attacker who successfully redirects traffic might observe or manipulate requests before they reach the legitimate DynamoDB endpoint.

The exposure is amplified when services within Chi use unencrypted HTTP clients or when node discovery mechanisms rely on IP-to-hostname mappings that do not validate ARP integrity. Combined with DynamoDB’s eventual consistency model, an attacker might delay or reorder requests to produce inconsistent reads or writes. Because Chi’s runtime does not inherently protect against layer-2 deception, operators must enforce transport security and validate endpoint identities independently of ARP.

Remediation focuses on ensuring that all DynamoDB interactions from Chi services use encrypted, authenticated channels and that host verification is performed independently of ARP. Below are concrete examples in Erlang/Chi style that demonstrate secure practices.

First, enforce HTTPS with strict certificate validation when connecting to DynamoDB. Using the hackney HTTP client, configure TLS options and verify the server certificate against a trusted CA:

%% Secure DynamoDB HTTPS request with certificate validation
connect_dynamodb_secure() ->
    Url = "https://dynamodb.us-east-1.amazonaws.com",
    Opts = [
        {ssl, [{cacertfile, "/path/to/ca_bundle.pem"}, {verify, verify_peer}]},
        {hostname, "dynamodb.us-east-1.amazonaws.com"}
    ],
    case hackney:connect(Url, [], [], Opts) of
        {ok, client} ->
            {ok, 200, _, _} = hackney:request(get, "/", [], <<>>, client);
        {error, Reason} ->
            logger:error("Secure connection failed: ~p", [Reason])
    end.

Second, avoid relying on IP-based service discovery for DynamoDB endpoints. Instead, use DNS with DNSSEC or a configuration service that provides authenticated endpoints. If you must resolve hostnames programmatically, validate the result against an allowlist:

%% Validate DynamoDB endpoint against allowed patterns
validate_ddb_endpoint(Host) ->
    AllowedPatterns = ["dynamodb.\\.ap-southeast-1\\.amazonaws\\.com"],
    lists:any(fun(P) -> re:run(Host, P, [{capture, none}]) =:= match end, AllowedPatterns).

safe_dynamodb_request(Path) ->
    case validate_dynamodb_endpoint("dynamodb.us-east-1.amazonaws.com") of
        true ->
            %% Proceed with signed request using aws4_hmac
            aws4_hmac:sign_and_request(get, "https://dynamodb.us-east-1.amazonaws.com" ++ Path, [], #{});
        false ->
            {error, invalid_endpoint}
    end.

Third, use environment-controlled credentials and never embed them in code or configuration files that might be exposed through ARP spoofing. Leverage IAM roles or short-lived tokens retrieved over a secure channel:

%% Retrieve temporary credentials securely
get_temp_creds() ->
    Url = "https://sts.amazonaws.com",
    Headers = [{"Content-Type", "application/x-www-form-urlencoded"}],
    Body = "Action=GetCallerIdentity&Version=2011-06-15",
    {ok, 200, _, Ref} = hackney:request(post, Url, Headers, Body, [{ssl, [{cacertfile, "/path/to/ca.pem"}]}]),
    {ok, BodyBinary} = hackney:body(Ref),
    parse_sts_response(BodyBinary).

Finally, monitor network anomalies that may indicate ARP spoofing, such as duplicate IP addresses appearing on different ports or unexpected MAC changes. Integrate these signals into your Chi observability layer to trigger alerts without assuming the middleware itself prevents layer-2 attacks.