Arp Spoofing with Bearer Tokens

Arp Spoofing attacks targeting Bearer Tokens typically exploit the trust relationships between network devices to intercept authentication credentials. In API contexts, attackers position themselves between clients and servers to capture Authorization: Bearer headers flowing through the network.

The most common attack vector involves ARP cache poisoning where the attacker sends falsified ARP messages to associate their MAC address with the IP address of a legitimate gateway or API server. When clients attempt to communicate with the API, their traffic routes through the attacker's machine instead.

Bearer Tokens are particularly vulnerable because they're often transmitted as HTTP headers without additional protection. An attacker performing ARP spoofing can capture Authorization headers containing tokens like:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Once captured, these tokens can be used immediately since Bearer Tokens lack built-in expiration verification mechanisms at the network level. The stateless nature that makes Bearer Tokens convenient for API authentication also makes them susceptible to replay attacks when network traffic is compromised.

Real-world incidents have shown ARP spoofing being used to harvest tokens from corporate networks, with attackers then accessing cloud APIs, databases, and internal services. The attack is particularly effective in environments with weak network segmentation or where ARP spoofing detection tools are absent.

Detecting ARP spoofing attacks targeting Bearer Tokens requires a multi-layered approach. Network-level detection involves monitoring for unusual ARP traffic patterns, such as multiple ARP replies from different MAC addresses for the same IP or rapid ARP table changes.

For API-specific detection, implement monitoring that flags suspicious Bearer Token usage patterns:

// Monitor for token reuse across different IP addresses or geographic locations
const detectSuspiciousTokenReuse = (tokenLogs) => {
  const ipAddresses = tokenLogs.map(log => log.clientIP);
  if (uniqueIPs.size > 1) {
    console.warn('Token used from multiple IPs:', [...uniqueIPs].join(', '));
  }
};

middleBrick's black-box scanning approach can identify APIs vulnerable to token interception by testing for:

• Missing HTTPS enforcement (tokens sent over HTTP)
• Lack of token binding to client characteristics
• Insufficient rate limiting that allows token replay
• Missing token rotation policies

The scanner tests unauthenticated attack surfaces by attempting to capture tokens through simulated network interception scenarios. It also checks for proper Content-Security-Policy headers and HSTS implementation that would prevent token leakage.

Runtime monitoring should include anomaly detection for:

// Detect unusual token activity patterns
const monitorTokenAnomalies = (requests) => {
  const tokenMap = new Map();
  requests.forEach(req => {
    const token = req.headers.authorization?.replace('Bearer ', '');
    if (token) {
      const key = `${token}_${req.endpoint}`;
      const record = tokenMap.get(key) || { count: 0, lastSeen: null };
      record.count++;
      record.lastSeen = Date.now();
      tokenMap.set(key, record);
    }
  });
  // Flag tokens with unusual usage patterns
 {
    if (record.count > THRESHOLD) {
      console.warn(`Suspicious token activity: ${key}`);
    }
  });
};

Securing Bearer Tokens against ARP spoofing requires implementing defense-in-depth strategies. The foundation is always using HTTPS/TLS to encrypt token transmission, but additional measures provide critical protection.

Token binding ties the token to specific client characteristics, making stolen tokens less useful:

// Implement token binding using client IP and user agent
const createBoundToken = (payload, clientIP, userAgent) => {
  const token = jwt.sign({
    ...payload,
    ip: clientIP,
    userAgent: userAgent,
    issuedAt: Date.now()
  }, process.env.JWT_SECRET, { expiresIn: '1h' });
  return token;
};

// Verify token binding on subsequent requests
const verifyBoundToken = (token, clientIP, userAgent) => {
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    if (decoded.ip !== clientIP || decoded.userAgent !== userAgent) {
      throw new Error('Token binding mismatch');
    }
    return decoded;
  } catch (error) {
    throw new Error('Invalid or expired token');
  }
};

Short token lifetimes and refresh token rotation significantly reduce the window of opportunity for attackers:

// Implement short-lived access tokens with refresh mechanism
const generateAuthTokens = (userId) => {
  const accessToken = jwt.sign({
    userId,
    type: 'access'
  }, process.env.JWT_SECRET, { expiresIn: '15m' });
  
  const refreshToken = jwt.sign({
    userId,
    type: 'refresh'
  }, process.env.REFRESH_SECRET, { expiresIn: '7d' });
  
  return { accessToken, refreshToken };
};

// Secure refresh token rotation
const refreshToken = (oldRefreshToken, clientIP) => {
  try {
    const decoded = jwt.verify(oldRefreshToken, process.env.REFRESH_SECRET);
    if (decoded.type !== 'refresh') throw new Error('Invalid token type');
    
    // Invalidate old refresh token
    await invalidateRefreshToken(oldRefreshToken);
    
    // Issue new tokens
    return generateAuthTokens(decoded.userId);
  } catch (error) {
    throw new Error('Refresh failed: ' + error.message);
  }
};

Network-level defenses complement token security:

// Implement API-side ARP spoofing detection
const detectArpSpoofing = (request) => {
  const clientIP = request.ip;
  const userAgent = request.get('User-Agent');
 
  // Check if this IP/userAgent combination has suddenly changed behavior
  const recentActivity = await getRecentActivity(clientIP, userAgent);
    console.warn('Possible ARP spoofing detected:', {
      clientIP,
      userAgent,
      previousLocation: recentActivity.location,
      currentLocation: request.location
    });
    // Trigger additional verification
    return await performAdditionalVerification(request);
  }
  return true;
};