System and method for utilizing DHCP relay to police DHCP address assignment in ransomware protected network
A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication by overwriting the DHCP responses. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined. Additionally, the DHCP address assignment may be policed to ensure accuracy and correctness to provide an additional layer of security.
1. A computer-implemented method of ransomware protection in a Virtual Local Area Network (VLAN) network, comprising:
configuring a security appliance as a DHCP relay for a Dynamic Host Configuration Protocol (DHCP) server in the VLAN network;
receiving, by the security appliance, responses from the DHCP server to DHCP requests and the security appliance further overwriting a subnet mask associated with the responses to 255.255.255.255 to set the security appliance as a default gateway for a plurality of endpoint devices of the VLAN network; and
intercepting, by the security appliance, DHCP packets between the DHCP server and endpoint devices and policing, by the security appliance, 1) Internet Protocol (IP) addresses requested by client endpoint devices, and 2) IP addresses proposed by the DHCP server; and
wherein the policing of IP address assignments by the security appliance is selected to aid in protecting the security of the endpoint devices from ransomware.
2. The computer-implemented method of claim 1 , further comprising configuring IP addresses of the DHCP server and the DHCP relay to include at least one of a dynamic IP pool, reserved addresses, Media Access Control (MAC) addresses, and static IP addresses.
3. The computer-implemented method of claim 2 , wherein an assignment of different types of IP addresses assigned to particular endpoint devices is implemented to enhance security against ransomware attacks by preventing malevolent entities from acquiring a valid client endpoint device via DHCP.
4. The computer-implemented method of claim 1 , wherein the policing of IP address assignments comprises performing at least one action to stop, reject, or decline accepting IP addresses with pre-selected address attributes.
5. The computer-implemented method of claim 4 , wherein the pre-selected address attributes correspond to banned MAC addresses and the method responds to banned Media access Control (MAC) addresses with a Negative Acknowledgement (NACK).
6. The computer-implemented method of claim 1 , wherein a client endpoint device requesting a renewal of an address is reassigned a different reserved address.
7. The computer-implemented method of claim 1 , wherein the IP address assignments include at least one of: 1) modifying ciaddr requested by an endpoint device in a DHCP DISCOVER/REQUEST, 2) modifying yiaddr assigned to an endpoint device in a DHCP OFFER, 3) generated a DHCP Negative Acknowledgement (NACK) in response to a client DHCP Discover or Request, 4) proactively drop a DHCP OFFER/Acknowledgement (ACK) packet being sent to a client; and 5) generate a DHCP decline to a DHCP Server in response to a DHCP OFFER.
8. The computer-implemented method of claim 1 , further comprising:
detecting, by the security appliance, lateral propagation of ransomware between endpoint devices via intra-VLAN communication in the VLAN network.
9. A system for ransomware protection in a Virtual Local Area Network (VLAN) network, comprising:
a security appliance acting as a Dynamic Host Configuration Protocol (DHCP) relay for a DHCP server in the VLAN network;
the security appliance serving as the default gateway for a plurality of endpoint devices of the shared VLAN network by the security appliance, overwriting a subnet mask to 255.255.255.255 of responses to the DHCP server to set the security appliance as a default gateway; and
the security appliance further policing DHCP Internet Protocol (IP) address assignments by intercepting, by the security appliance, DHCP packets between the DHCP server and endpoint devices and policing, by the security appliance, 1) IP addresses requested by client endpoint devices, and 2) IP addresses proposed by the DHCP server, wherein the policing of IP address assignments by the security appliance is selected to aid in protecting the security of the endpoint devices from ransomware.
10. The system of claim 9 , where the IP addresses of the DHCP server and the DHCP relay are configurable to include at least one of a dynamic IP pool, reserved addresses, Media Access Control (MAC) addresses, and static IP addresses.
11. The system of claim 9 , wherein an assignment of different types of IP addresses assigned to particular endpoint devices is implemented to enhance security against ransomware attacks by preventing malevolent entities from acquiring a valid client endpoint device via DHCP.
12. The system of claim 9 , wherein the policing of IP address assignments comprises performing at least one action to stop, reject, or decline accepting IP addresses with pre-selected address attributes.
13. The system of claim 12 , wherein the pre-selected address attributes correspond to banned MAC addresses and the system-responds to the banned MAC addresses with a Negative Acknowledgement (NACK).
14. The system of claim 9 , wherein an endpoint device requesting a renewal of an address is reassigned a different reserved address.
15. The system of claim 9 , wherein the policing includes examining DHCP protocol packets between the DHCP server and endpoint devices and performing at least one of: 1) modifying ciaddr requested by an endpoint device in a DHCP DISCOVER/REQUEST, 2) modifying yiaddr assigned to an endpoint device in a DHCP OFFER, 3) generated a DHCP Negative Acknowledgement (NACK) in response to an endpoint device DHCP Discover or Request, 4) proactively dropping a DHCP OFFER/Acknowledgement (ACK) packet being sent to an endpoint device; and 5) generating a DHCP decline to a DHCP Server in response to a DHCP OFFER.
16. A method for providing ransomware protection in a Virtual Local Area Network (VLAN) network, comprising:
relaying, by a security appliance having a Dynamic Host Configuration Protocol (DHCP) relay function, DHCP requests from a plurality of endpoint devices to a DHCP server, the security appliance further overwriting a subnet mask of responses to the DHCP server to 255.255.255.255 to set the security appliance as a default gateway for the plurality of endpoint devices of the VLAN network;
monitoring, by the security appliance, intra-VLAN communication between the plurality of endpoint devices of the VLAN network; and
policing, by the security appliance, DHCP address assignments of endpoint devices.