Arp Spoofing in Mysql

ARP spoofing is a layer-2 network attack where an adversary sends forged ARP messages onto a local network, linking their MAC address with the IP address of a legitimate server (like a MySQL database). This causes traffic intended for the MySQL server to be redirected through the attacker's machine. In a MySQL context, this is particularly dangerous because database traffic is often unencrypted by default, allowing for credential theft, data exfiltration, or man-in-the-middle manipulation of queries and results.

The attack typically unfolds when a MySQL client application (e.g., a web app backend) and the database server reside on the same broadcast domain (VLAN, subnet). An attacker with network access can poison the ARP caches of both the client and the MySQL server. For the client, the attacker's MAC becomes associated with the server's IP. For the server, the attacker's MAC becomes associated with the client's IP. This bidirectional hijacking creates a transparent interception point.

MySQL-specific manifestation occurs at the protocol level. The MySQL client-server protocol (C/S) sends authentication credentials (username, password hash) in the initial handshake packet if not using SSL/TLS. An attacker performing ARP spoofing can capture this packet using tools like Wireshark or tcpdump. Even with SSL, if certificate validation is disabled or weak, the attacker can position themselves to perform a TLS stripping or proxy attack, presenting a self-signed certificate to the client while establishing a valid connection to the real server.

Example vulnerable connection in an application:

// PHP (mysqli) without SSL enforcement - traffic is plaintext on the wire
$conn = new mysqli('db.internal.company.com', 'app_user', 'password123', 'app_db');
if ($conn->connect_error) {
    die('Connection failed: ' . $conn->connect_error);
}

This code sends the password 'password123' in a reversible form over the network. An ARP spoofer intercepting the traffic between the web server and 'db.internal.company.com' would obtain this credential.

ARP spoofing itself is a network-layer attack, not a MySQL protocol flaw. However, middleBrick detects the critical configuration weaknesses in MySQL deployments that make them vulnerable to this class of attack. The scanner performs black-box tests against the API endpoints that manage or interact with database connections, looking for misconfigurations that indicate unencrypted traffic or lax network controls.

The scanner's relevant checks include:

• Encryption (TLS/SSL) Enforcement: middleBrick probes for the presence and strict enforcement of TLS. It tests if the MySQL connection requires SSL and if certificate validation is mandatory. A finding of 'Disabled' or 'Optional' SSL is a critical indicator of vulnerability to ARP spoofing.
• Data Exposure: This check scans for sensitive data (credentials, PII) transmitted in clear text. middleBrick's analysis of API responses and request patterns can identify if database connection strings or credentials are being passed without encryption.
• Network Configuration Analysis: While middleBrick does not scan the internal network directly, it can correlate findings. If an API endpoint that should be internal-only (e.g., a health check for a database cluster) is exposed on a public interface, it suggests poor network segmentation, increasing the attack surface for ARP spoofing.

A typical middleBrick scan of an application's configuration API might reveal:

You can run a scan yourself using the CLI tool to assess your API's configuration:

middlebrick scan https://api.your-application.com/config

The resulting report will highlight if your application's database connection configuration is susceptible to network eavesdropping via ARP spoofing.

Remediation focuses on enforcing mandatory, validated TLS for all MySQL connections and implementing strict network segmentation. The goal is to ensure that even if an attacker successfully performs ARP spoofing, the intercepted traffic is encrypted end-to-end and the attacker's proxy certificate will be rejected.

1. Configure MySQL Server for TLS Enforcement

On the MySQL server (e.g., MySQL 8.0), generate or obtain server SSL certificates and configure the server to require TLS:

-- In my.cnf or my.ini under [mysqld]
require_secure_transport = ON
ssl_cert = /path/to/server-cert.pem
ssl_key = /path/to/server-key.pem
ssl_ca = /path/to/ca.pem

The require_secure_transport = ON setting is critical. It forces all client connections to use TLS. Connections attempting to use plaintext will be rejected with an error.

2. Configure MySQL Clients for Strict TLS Validation

Client applications must be configured to use SSL and verify the server's certificate against a trusted Certificate Authority (CA). Never disable verification (verify_server_cert = FALSE).

Example in Python (mysql-connector-python):

import mysql.connector

config = {
    'user': 'app_user',
    'password': 'secure_password',
    'host': 'db.internal.company.com',
    'database': 'app_db',
    'ssl_ca': '/path/to/ca.pem',  # Path to CA cert that signed server cert
    'ssl_verify_cert': True,
    'ssl_verify_identity': True  # MySQL 8.0.30+; validates hostname
}

cnx = mysql.connector.connect(**config)

Example in Java (JDBC):

String url = "jdbc:mysql://db.internal.company.com:3306/app_db?" +
            "useSSL=true&" +
            "requireSSL=true&" +
            "verifyServerCertificate=true&" +
            "clientCertificateKeyStoreUrl=file:path/to/client-keystore.jks&" +
            "clientCertificateKeyStorePassword=changeit&" +
            "trustCertificateKeyStoreUrl=file:path/to/truststore.jks&" +
            "trustCertificateKeyStorePassword=changeit";

Connection conn = DriverManager.getConnection(url, "app_user", "secure_password");

3. Network Segmentation

Place MySQL servers on a dedicated, isolated backend network segment (e.g., a private subnet in AWS, a VLAN with no direct internet access). Use firewall rules (security groups, ACLs) to restrict database port 3306 access only to specific application server IPs. This limits the network scope where an ARP spoofer could operate.

4. Continuous Monitoring

Use middleBrick Pro to continuously monitor your API endpoints for configuration drift. A scheduled scan can alert you if a new connection string without SSL is introduced or if an old, insecure configuration is redeployed. Integrate the middleBrick GitHub Action to fail a pull request if a scan of a staging environment detects a drop in the encryption score.