Arp Spoofing in Cassandra
How ARP Spoofing Manifests in Cassandra
ARP spoofing (also called ARP poisoning) is a layer‑2 attack where an attacker sends falsified ARP replies to associate their MAC address with the IP address of another host on the same LAN. When successful, traffic intended for the victim is routed through the attacker, who can then sniff, modify, or drop packets.
In a Cassandra cluster this matters because Cassandra nodes communicate with each other and with clients over TCP ports (default 9042 for the native protocol, 7000/7001 for internode gossip and storage service, and optionally 9160 for the deprecated Thrift interface). If the network segment carrying this traffic is not protected, an attacker who has gained ARP spoofing capability can:
- Intercept CQL traffic between an application and a Cassandra node, capturing credentials (if authentication is not enabled) or query results.
- Inject or alter CQL statements in flight, potentially executing unauthorized reads/writes.
- Disrupt internode communication, causing nodes to miss gossip updates or fail to replicate data, which can lead to inconsistency or denial‑of‑service.
The attack surface is amplified when Cassandra is deployed without encryption or authentication. In the default configuration:
server_encryption_optionsandclient_encryption_optionsare set tofalse, meaning traffic is plain TCP.authenticatorisorg.apache.cassandra.auth.AllowAllAuthenticator, allowing any client to connect without credentials.
Under these conditions, an ARP spoofing attacker can simply read the raw CQL frames, extract usernames/passwords (if the application uses plain‑text authentication), or replay captured sessions. Even when authentication is enabled, lack of encryption still exposes query text and results.
Cassandra‑specific code paths that handle this traffic include:
- The
org.apache.cassandra.transportpackage, which implements the native protocol server and client channels. - The
org.apache.cassandra.netpackage, responsible for internode messaging via TCP sockets. - The
org.apache.cassandra.service.StorageServicegossip daemon, which also uses TCP for state exchange.
If any of these paths carry unencrypted, unauthenticated traffic, ARP spoofing becomes a viable vector for data interception or manipulation.
Cassandra‑Specific Detection
Detecting the risk introduced by ARP spoofing starts with verifying that Cassandra communications are protected by encryption and authentication. Because middleBrick is an API‑focused scanner, it evaluates the exposed API surface (e.g., the CQL native protocol port when wrapped by a thin HTTP gateway, or any HTTP‑based Cassandra API such as DataStax Astra’s REST interface). The scanner reports findings that directly map to the mitigations needed against ARP spoofing.
When you run a scan against a Cassandra endpoint, middleBrick checks for:
- Missing encryption – the service accepts plain‑text connections on the expected port.
- Missing authentication – the service allows connections without valid credentials.
- Excessive exposure** – the service is reachable from untrusted networks (e.g., the scanner’s external vantage point).
These findings are presented with severity ratings and remediation guidance, enabling you to prioritize fixing the gaps that would otherwise be exploitable after an ARP spoofing attempt.
Example: scanning a Cassandra HTTP gateway exposed at https://api.example.com/cassandra:
# Install the middleBrick CLI (npm package)
npm i -g middlebrick
# Run a scan; the tool returns JSON with a score and findings
middlebrick scan https://api.example.com/cassandra --output json
The resulting JSON might include entries such as:
| Finding | Severity | Description |
|---|---|---|
| Missing TLS encryption | High | The endpoint accepts plain HTTP; traffic is not protected against sniffing. |
| No authentication required | Medium | Any client can connect and issue CQL‑like commands. |
These results give you concrete, actionable data to harden the Cassandra deployment against ARP‑based interception.
Cassandra‑Specific Remediation
Mitigating ARP spoofing risk in Cassandra focuses on encrypting and authenticating all traffic, both between nodes and between clients and nodes. The following configuration changes use only Cassandra’s native features; no external agents or middleware are required.
1. Enable internode encryption
Edit cassandra.yaml on every node:
server_encryption_options:
internode_encryption: all
keystore: conf/.keystore
keystore_password: cassandra
truststore: conf/.truststore
truststore_password: cassandra
protocol: TLS
algorithm: SunX509
store_type: JKS
cipher_suites: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
require_client_auth: false
Setting internode_encryption: all forces encryption for gossip, storage service, and internode streaming.
2. Enable client‑to‑node encryption
Still in cassandra.yaml:
client_encryption_options:
enabled: true
keystore: conf/.keystore
keystore_password: cassandra
truststore: conf/.truststore
truststore_password: cassandra
protocol: TLS
algorithm: SunX509
store_type: JKS
cipher_suites: [TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
require_client_auth: true # optional, enforces client certs
With this enabled, the native protocol port (9042) will only accept TLS‑wrapped connections.
3. Activate authentication and authorization
In cassandra.yaml set:
authenticator: PasswordAuthenticator
authorizer: CassandraAuthorizer
roles_validity_in_ms: 2000
permissions_validity_in_ms: 2000
After restarting, create a superuser and then regular accounts via CQL:
cqlsh -u cassandra -p cassandra
CREATE ROLE app_user WITH PASSWORD = 'StrongPass123!' AND LOGIN = true;
GRANT SELECT, MODIFY ON KEYSPACE my_keyspace TO app_user;
4. Configure the DataStax Java driver to use TLS
When connecting from an application, enable SSL in the driver configuration:
DatastaxJavaDriver {
basic.contact-points = ["cassandra-node1.example.com:9042"]
basic.load-balancing-policy.local-datacenter = "dc1"
advanced.ssl-engine-factory {
class = DefaultSslEngineFactory
truststore.path = "/path/to/truststore.jks"
truststore.password = "cassandra"
}
auth-provider {
class = PlainTextAuthProvider
username = "app_user"
password = "StrongPass123!"
}
}
Using the driver in this way guarantees that the TCP socket is upgraded to TLS before any CQL frames are exchanged.
5. Network‑level hardening (complementary)
While encryption and authentication protect the data plane, restrict the Cassandra ports to trusted subnets via security groups or host‑based firewalls. This limits the attacker’s ability to position themselves on the same LAN as the nodes, reducing the feasibility of ARP spoofing.
By applying the above Cassandra‑native controls, you eliminate the plain‑text, unauthenticated channels that ARP spoofing would otherwise exploit, thereby protecting both data in transit and cluster integrity.