Arp Spoofing on Azure

Arp Spoofing in Azure environments typically occurs through compromised virtual machines or misconfigured network security groups. Unlike traditional ARP spoofing on physical networks, Azure's virtualized networking layer introduces unique attack vectors that security teams must understand.

In Azure, ARP spoofing can manifest when an attacker gains control of a VM and uses it to intercept traffic between other VMs on the same subnet. The attacker VM sends forged ARP responses, claiming to be the gateway or other target VM, causing legitimate traffic to be redirected through the compromised node.

Azure's Software-Defined Networking (SDN) uses Hyper-V Network Virtualization (HNV) to isolate tenant networks. However, within a single tenant's virtual network, VMs can still perform ARP spoofing if network security policies aren't properly configured. This is particularly dangerous in shared services environments where multiple applications share the same subnet.

Common Azure-specific scenarios include:

• Compromised build agents in Azure DevOps pipelines redirecting build artifacts
• Malicious containers in Azure Kubernetes Service (AKS) intercepting inter-pod traffic
• Virtual network peering misconfigurations allowing lateral movement
• Azure Bastion session hijacking through ARP cache poisoning

The Azure Resource Manager API and Service Bus can also be targeted. An attacker might use ARP spoofing to intercept authentication tokens or API calls between services, leading to credential theft or data exfiltration.

const { DefaultAzureCredential } = require("@azure/identity");
const { KeyClient } = require("@azure/keyvault-keys");

// Vulnerable pattern - no network isolation
const credential = new DefaultAzureCredential();
const client = new KeyClient("https://mykeyvault.vault.azure.net", credential);

// Attacker intercepts the credential exchange
const interceptedToken = await credential.getToken("https://management.azure.com/.default");
console.log("Intercepted token: ", interceptedToken.token);

This code demonstrates how an attacker with ARP spoofing capabilities could intercept Azure AD token exchanges, gaining unauthorized access to Azure Key Vault or other protected resources.

Detecting ARP spoofing in Azure requires monitoring both network-level and application-level indicators. Azure Network Watcher provides flow logs and security group analytics that can help identify suspicious traffic patterns indicative of ARP spoofing.

Key detection methods include:

• Network Security Group (NSG) flow log analysis for unusual traffic patterns
• Azure Monitor alerts on repeated ARP request/response mismatches
• Virtual machine network interface monitoring for abnormal MAC address changes
• Service endpoint traffic analysis for unexpected data flows

middleBrick's Azure-specific scanning can identify ARP spoofing vulnerabilities by testing network configurations and API endpoints. The scanner checks for exposed endpoints that could be used in ARP-based attacks and validates network security group rules.

# middleBrick scan output showing ARP-related findings
{
  "findings": [
    {
      "category": "Network Security",
      "severity": "HIGH",
      "title": "Unrestricted Virtual Network Peering",
      "remediation": "Implement network security group rules to restrict traffic between peered networks"
    },
    {
      "category": "Authentication",
      "severity": "MEDIUM",
      "title": "Missing Network Isolation",
      "remediation": "Use Azure Private Endpoints to isolate service access"
    }
  ]
}

Azure Security Center also provides threat protection that can detect ARP spoofing attempts. The Defender for Cloud integrates with Network Watcher to provide real-time alerts when suspicious ARP traffic is detected.

For API endpoints, middleBrick scans for vulnerabilities that could be exploited in conjunction with ARP spoofing:

# Azure CLI commands for ARP spoofing detection
az network watcher flow-log show --resource-group <rg> --name <flow-log>
az network watcher security-group-view show --resource-group <rg> --name <vm-name>
az monitor diagnostic-settings show --resource <resource-id> --name <settings-name>

These commands help security teams identify misconfigurations that could enable ARP spoofing attacks within Azure environments.

Remediating ARP spoofing in Azure requires a multi-layered approach combining network configuration, service isolation, and code-level protections. Azure provides several native features to mitigate these attacks.

Network Security Groups (NSGs) should be configured with explicit deny rules for ARP traffic between unrelated services. Use application security groups to define fine-grained network policies:

# Azure CLI - Create isolated network configuration
az network nsg rule create --resource-group <rg> --nsg-name <nsg> --name "Deny-ARP-Spoofing" 
    --priority 100 --direction Inbound --access Deny 
    --source-address-prefixes "VirtualNetwork" --destination-address-prefixes "VirtualNetwork" 
    --protocol ARP --description "Block ARP spoofing attempts"

Azure Private Link provides network isolation by creating private endpoints for Azure services, preventing ARP-based attacks on service endpoints:

# Terraform - Azure Private Endpoint configuration
resource "azurerm_private_endpoint" "keyvault" {
  name                = "keyvault-private-endpoint"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  subnet_id           = azurerm_subnet.private.id

  private_service_connection {
    name                           = "keyvault-connection"
    private_connection_resource_id = azurerm_key_vault.kv.id
    subresource_names              = ["vault"]
    is_manual_connection           = false
  }
}

Code-level remediation involves implementing mutual TLS (mTLS) between services to ensure encrypted communication even if ARP spoofing occurs:

# Azure App Service - mTLS configuration
az webapp config ssl bind --resource-group <rg> --name <app-service> --certificate-thumbprint <thumbprint> --ssl-type SniSsl

# Azure Function - Service Endpoint configuration
az functionapp config access-restriction add --resource-group <rg> --name <function-app> 
    --service-tag AzureKeyVault --action Allow

For Azure Kubernetes Service, implement network policies to restrict pod-to-pod communication:

# AKS Network Policy - Deny all ingress except from specific pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-server-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: api-server
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: client
    ports:
    - protocol: TCP
      port: 80

middleBrick's continuous monitoring in Pro tier can automatically detect when ARP spoofing vulnerabilities reappear after remediation, providing ongoing protection for Azure environments.