Prevention of PAC File Based Attack Using DHCP Snooping

Abstract

As part of configuring a large number of systems within a network, the Proxy-Auto Configuration (PAC) file is used to have a common configuration. This is done by using the feature called Web Proxy Auto Discovery (WPAD) that helps the browser to determine the available PAC file. PAC file path is configured in DHCP servers. The attacker impersonates as the DHCP server and provides the malicious PAC file to the user. PAC file determines the proxy server to be used for a particular Uniform Resource Locator (URL). Attacker has to be on the same network as the victim or able to spoof DHCP response packets. The PAC file is retrieved from the attacker web server. The attacker replaces the PAC file with malicious PAC file that can redirect traffic to the attacker IP address. Victim is redirected to the attacker controlled proxy server. The attacker is able to view the URL the victim visits. This is performed before a secure connection is established between the client and the web server. This attack can be mitigated by using a technique called DHCP snooping in switches that can verify DHCP messages passing through the switch that prevents impersonation of DHCP server.