Arp Spoofing in Chi with Firestore

Arp Spoofing is a Layer 2 attack where an adversary sends falsified Address Resolution Protocol messages to associate their MAC address with the IP of a legitimate host, typically the gateway or another service on the local network. In Chi, a server-side web framework for the Erlang ecosystem, applications that interact with Google Cloud Firestore over a shared or untrusted network segment can be exposed if the network path between the Chi node and Firestore endpoints is compromised. Firestore itself is a managed service, so the protocol boundary is typically HTTPS; however, the local network segment that carries traffic from Chi to the public Internet can be manipulated via Arp Spoofing to intercept or redirect traffic before it leaves the host.

When a Chi application resolves Firestore hostnames to IPs and the local ARP cache is poisoned, responses intended for Firestore may be sent to the attacker’s machine. Although Firestore APIs require strong authentication (e.g., service account credentials or OAuth2 tokens), intercepted traffic may still expose sensitive metadata, such as instance identity, endpoint timing patterns, or unencrypted ancillary data if any part of the pipeline inadvertently allows cleartext exposure. Moreover, successful redirection can enable session hijacking or man-in-the-middle behaviors if the Chi application does not strictly enforce certificate pinning or host verification. While Firestore enforces transport-layer encryption, the risk in Chi arises from the local network trust assumptions: if an attacker can insert themselves at the link layer, the confidentiality and integrity of requests in-flight from Chi to Firestore may be undermined, especially in containerized or shared-hosting environments where network isolation is weaker.

middleBrick detects scenarios where unauthenticated endpoints might be exposed to network-level tampering by testing the unauthenticated attack surface and including network-related checks where applicable. Although middleBrick does not fix low-level OS or network configurations, its findings can highlight weak network boundaries and encourage stronger transport security practices when integrating Chi with external services like Firestore.

Remediation focuses on ensuring that your Chi application robustly validates server certificates, uses strict hostname verification, and avoids relying on potentially poisoned local network state for security-critical operations. Below are concrete examples using the Google Cloud Firestore client for Erlang via the google_gax and related HTTP client stack that Chi typically uses, demonstrating secure request construction and environment hardening.

1. Enforce strict TLS and hostname verification

Ensure your HTTP client used by Chi verifies TLS certificates and server hostnames. If you use gun or hackney directly, configure them to reject self-signed certificates and to validate the Common Name and Subject Alternative Names against the expected Firestore host.

{ok, ConnPid} = gun:open("firestore.googleapis.com", 443, #{transport => tls, verify => verify_peer, cacerts => load_system_certs()}.

In Chi, you can centralize this configuration in your connection setup so that all Firestore-bound requests inherit strict verification.

2. Use Application Default Credentials with minimal scopes

When authenticating to Firestore from Chi, prefer Application Default Credentials (ADC) and scope requests to the minimum required IAM permissions. This reduces the impact of credential leakage, even if network-layer attacks occur.

% Example using google_auth_library via environment and explicit scopes
AuthOpts = [
  {type, "service_account"},
  {scopes, ["https://www.googleapis.com/auth/datastore"]}
].
{ok, Creds} = google_auth:get_application_default(AuthOpts).

3. Avoid hardcoding endpoints; validate Firestore host resolution

Do not override or bypass standard DNS resolution for Firestore endpoints. If your Chi deployment uses custom DNS or environment variables for hostnames, validate that they resolve to expected IP ranges and are not trivially overridden by runtime configuration mistakes.

% Resolve hostname safely and compare against an allowlist if needed
case inet:gethostbyname("firestore.googleapis.com") of
  {ok, #hostent{h_addr_list = [Addr|_]}} ->
    case lists:member(Addr, allowed_addrs()) of
      true  -> proceed_to_connect(Addr);
      false -> {error, unauthorized_host}
    end;
  _ -> {error, resolution_failed}
end.

4. Add request-level integrity checks where applicable

For highly sensitive operations, include additional application-level tokens or metadata that are verified server-side, providing a second layer of assurance that the request originated from your Chi service and was not tampered with after being intercepted (defense in depth).

% Include an X-Request-ID and server-side verification token in headers
Headers = [
  {"X-Request-ID", uuid:to_string(uuid:uuid4())},
  {"X-Integrity-Token", compute_hmac(payload, secret_key)}
],
hackney:request(post, "https://firestore.googleapis.com/v1/projects/...", Headers, Payload, Opts).

5. Use middleBrick to validate external exposure and endpoint behavior

Run scans via the CLI or Web Dashboard to confirm that your API surface—whether directly exposed endpoints or Firestore-dependent services behind Chi—does not inadvertently leak information or accept malformed inputs. middleBrick’s checks complement secure coding by providing an external view of risk posture.

CLI: middlebrick scan <url>

GitHub Action: add API security checks to your CI/CD pipeline

Pro plan continuous monitoring can be configured to alert on regressions in security scores when network or dependency changes occur.