Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
Layer 2 Security <ul><ul><li>Toronto Information Security  </li></ul></ul><ul><ul><li>Sami Kamel </li></ul></ul><ul><ul><l...
The Threat <ul><li>The OSI model was built to allow different layers to work without knowledge of each other, and that mea...
Data link layer technologies Background about technologies affected by the following attacks  <ul><li>Switch operation (Un...
Attack Types <ul><ul><li>CAM table overflow. </li></ul></ul><ul><ul><li>VLAN hopping.   </li></ul></ul><ul><ul><li>Spannin...
MAC Flood <ul><li>Dsniff (macof) can generate 155,000 mac/min. </li></ul><ul><li>CAM tables size (cisco switches 16kb to 1...
VLAN Hopping <ul><li>A malicious user on a VLAN trying to send packets to a system on a different VLAN. </li></ul><ul><li>...
Switch Spoofing   <ul><li>Trunk ports have access to all VLANs traffic </li></ul><ul><li>When the malicious user can spoof...
Double tagging 802.1q <ul><li>Attacker send a double encapsulated frame 802.1q.  The first tag will get stripped off by th...
STP Manipulation <ul><li>Spanning Tree Protocol (STP) exists to prevent Layer 2 loops from being formed when switches or b...
STP/RSTP Pitfalls <ul><li>Lack of authentication in BPDU messages </li></ul><ul><li>  If a malicious user impersonates a s...
MAC Spoof <ul><li>ARP works by sending broadcasts to find the MAC address corresponding to an IP. </li></ul><ul><li>The at...
Private VLAN <ul><li>PVLAN restricts communication between ports in the same VLAN by assigning ports roles (Isolated, Prom...
DHCP Starvation <ul><li>Broadcasts of DHCP requests with spoofed MAC addresses to exhaust the DHCP server IP pool. </li></...
Configuration best practice <ul><li>Use dedicated VPAN for all trunk ports. </li></ul><ul><li>Avoid using VLAN 1. </li></u...
References & Links <ul><li>http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/sfblu_wp.pdf </li></ul><ul><li>http://www...
Upcoming SlideShare
Loading in …5
×

Network Security - Layer 2

11,981 views

Published on

The Data link layer is often overlooked and trusted as it is limited by the organization physical boundaries.. is this true ?

Published in: Technology
  • it should be download
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Network Security - Layer 2

  1. 1. Layer 2 Security <ul><ul><li>Toronto Information Security </li></ul></ul><ul><ul><li>Sami Kamel </li></ul></ul><ul><ul><li>[email_address] </li></ul></ul><ul><ul><li>February 2008 </li></ul></ul>
  2. 2. The Threat <ul><li>The OSI model was built to allow different layers to work without knowledge of each other, and that means that if a layer is compromised the other layers will not be aware “ Domino effect” . </li></ul><ul><li>i.e layer 3 will not be aware if layer 2 is attacked. </li></ul><ul><li>Facts: </li></ul><ul><li>A layer2 attack is hard to achieve from the outside world, but never underestimate the local attacker. the attacker may not be so local after all—backdoors and wireless hacking allow remote crackers. </li></ul><ul><li>99% of enterprise network ports are open(according to FBI report). </li></ul><ul><li>59% Insider attacks by employees. </li></ul><ul><li>Being in the LAN layer 2 is considered trusted by Security Ops and firewall/IDS/IPS technologies offer limited capabilities at layer 2. </li></ul><ul><li>More Broadband providers deploy access networks based exclusively on L2 for many reasons, worth mentioning the convergence time of RSTP is faster compared to OSPF and EIGRP, Ethernet interfaces are cheaper (Ex Wireless, Metro Ethernet), ease of connection to customer network. </li></ul><ul><li>The effect of a DOS attack on on L2 takes another dimension than in WAN as the BW is considerably higher. </li></ul>
  3. 3. Data link layer technologies Background about technologies affected by the following attacks <ul><li>Switch operation (Unicast, Broadcast/Multicast)‏ </li></ul><ul><li>Content-Addressable Memory (CAM) (ARP)table address-learning process. </li></ul><ul><li>VLAN,Cisco Inter switch Link (ISL), IEEE 802.1q. </li></ul><ul><li>Spanning tree Protocol(STP). </li></ul><ul><li>Rapid STP (RSTP). </li></ul><ul><li>Bridge Protocol Data Unit (BPDU). </li></ul>
  4. 4. Attack Types <ul><ul><li>CAM table overflow. </li></ul></ul><ul><ul><li>VLAN hopping. </li></ul></ul><ul><ul><li>Spanning Tree Protocol (STP) manipulation. </li></ul></ul><ul><ul><li>MAC Spoofing(ARP poisoning). </li></ul></ul><ul><ul><li>Private VLAN. </li></ul></ul><ul><ul><li>DHCP attacks. </li></ul></ul><ul><ul><li>Attacks techniques achieve Access, DOS, MITM. </li></ul></ul>
  5. 5. MAC Flood <ul><li>Dsniff (macof) can generate 155,000 mac/min. </li></ul><ul><li>CAM tables size (cisco switches 16kb to 128kb),(100 to over 100,000 entries) hence even if the CAM table refresh time is short it will not be short enough. (default in cisco is 5min).‏ </li></ul><ul><li>After the CAM table is flooded the switch enters a fail-open mode acting as a hub, forwarding traffic to all ports making sniffing easier, or achieving a DOS attack consuming switch processing power. </li></ul><ul><li>This attack can flood adjacent switches as well. </li></ul><ul><li>It is limited to the attacker VLAN. </li></ul><ul><li>MAC flood mitigation </li></ul><ul><li>Limit amount of MAC addresses to be learned / port. </li></ul><ul><li>Static mac addresses configuration (not scalable but most secure). </li></ul>
  6. 6. VLAN Hopping <ul><li>A malicious user on a VLAN trying to send packets to a system on a different VLAN. </li></ul><ul><li>Two main techniques are: </li></ul><ul><ul><li>Switch Spoofing. </li></ul></ul><ul><ul><li>802.1q Double Tagging. </li></ul></ul>
  7. 7. Switch Spoofing <ul><li>Trunk ports have access to all VLANs traffic </li></ul><ul><li>When the malicious user can spoof as a switch with ISL or 802.1q he will have access to all traffic, as trunk ports have access to all VLANs. </li></ul><ul><li>Port must be set to Trunk or to Auto (basically negotiates trunking), Or has DTP Dynamic trunking protocol on. </li></ul><ul><li>Tools </li></ul><ul><ul><li>Yersinia can spoof many protocols STP,ISL,802.1q,CDP,DTP,DHCP,HSRP,VTP. </li></ul></ul><ul><ul><li>Some Unix operating systems come with “brctl” a bridging utility STP capable. </li></ul></ul><ul><li>Mitigation </li></ul><ul><li>Disable unused Ports, set them to access mode. Disable unused Ports, set them to access mode, disable Dynamic trunking protocol on access ports(DTP allows the port to negotiate the trunking protocol with the other device )‏ </li></ul>
  8. 8. Double tagging 802.1q <ul><li>Attacker send a double encapsulated frame 802.1q. The first tag will get stripped off by the switch to which we are connected, and the packet will get forwarded to the next switch. However, a remaining tag contains a different VLAN to which the packet will be sent. </li></ul><ul><li>Works even if trunk port is set to off. </li></ul><ul><li>Limitations </li></ul><ul><ul><li>Unidirectional. (Not really as it can be DOS / turned Bidirectional using WEPWedgie ) </li></ul></ul><ul><ul><li>There must be multi-switches and obviously trunking. </li></ul></ul><ul><ul><li>Attacker and Trunk must have same native VLAN. </li></ul></ul><ul><ul><li>Does not work on ISL that does not have the concept of native VLAN. </li></ul></ul><ul><ul><li>Attacker cannot push data to a target on the same switch. </li></ul></ul>
  9. 9. STP Manipulation <ul><li>Spanning Tree Protocol (STP) exists to prevent Layer 2 loops from being formed when switches or bridges are interconnected via multiple paths for redundancy reasons. </li></ul><ul><li>Switches exchange BPDU messages to </li></ul><ul><ul><li>Elect a root bridge for all LANs, and calculate the shortest path to it. </li></ul></ul><ul><ul><li>Elect a per LAN designated bridge. </li></ul></ul><ul><ul><li>Designated bridge sends a BPDU in case of topology change up the tree to the root bridge that forwards it to other LANs. </li></ul></ul>
  10. 10. STP/RSTP Pitfalls <ul><li>Lack of authentication in BPDU messages </li></ul><ul><li> If a malicious user impersonates a switch and participates in the STP process, can create a DOS by consequently sending topology change BPDU messages all the switches will continuously recompute the algorithm. The user can also participate in the STP process by impersonating the root bridge and redirect traffic/sniff it. </li></ul><ul><li>Mitigation </li></ul><ul><li>Enable root guard on cisco equipment that enforces the placement of the root bridge in the network, or BPDU guard on users ports to disable the use of priority zero and hence becoming a root bridge. </li></ul>
  11. 11. MAC Spoof <ul><li>ARP works by sending broadcasts to find the MAC address corresponding to an IP. </li></ul><ul><li>The attacker overrides the CAM table entry so the switch forwards the packets destined for the host to the attacker. This allows the hacker to play MITM between two hosts or between the gateway and all hosts. </li></ul><ul><li>The attacker takes advantage of the GARP Gratuitous ARPs (unsolicited ARP replies). </li></ul><ul><li>Tools Ettercap and Arpspoof, they send less than an ARP per second so they are not detected by switch security features. </li></ul><ul><li>This attack is limited to the VLAN, cannot Hop vlans. </li></ul><ul><li>Mitigation </li></ul><ul><li>The DHCP messages are used to build an IP to MAC binding table containing (MAC, IP, lease time, binding type, VLAN number). The DHCP snooping feature builds the binding table and the Dynamic ARP inspection verifies the messages based on the binding table. </li></ul><ul><li>Use Arpwatch an open source that generates a log of IP-MAC pairings with timestamps. </li></ul><ul><li>Hard code static arp entries on OS “arp -s <ip> <mac>” </li></ul>
  12. 12. Private VLAN <ul><li>PVLAN restricts communication between ports in the same VLAN by assigning ports roles (Isolated, Promiscuous and Community). </li></ul><ul><li>The Proxy attack sends a packet with his IP/MAC and destination IP of target system and MAC of the router. (since switches are only MAC aware and routers only IP aware). </li></ul><ul><li>This attack is unidirectional as the PVLAN will block the victim response. </li></ul><ul><li>Mitigation </li></ul><ul><li>Configure access list on the router </li></ul>
  13. 13. DHCP Starvation <ul><li>Broadcasts of DHCP requests with spoofed MAC addresses to exhaust the DHCP server IP pool. </li></ul><ul><li>According to RFC 2131 a hacker can introduce a rogue DHCP server assigning clients IP addresses and acting as MITM while a DHCP server is already running. </li></ul><ul><li>Mitigation </li></ul><ul><li>DHCP authentication - RFC 3118 </li></ul><ul><li>No known usage by any commercial or private implementation since its adoption in 2001, most probably due to non scalable key distribution. </li></ul>
  14. 14. Configuration best practice <ul><li>Use dedicated VPAN for all trunk ports. </li></ul><ul><li>Avoid using VLAN 1. </li></ul><ul><li>Deploy port security. </li></ul><ul><li>Set users ports to non trunking. </li></ul><ul><li>Use ARP security options. </li></ul><ul><li>Use BPDU guard, Root guard. </li></ul><ul><li>Use PVLANs. </li></ul><ul><li>Disable CDP. </li></ul><ul><li>Disable unused ports and put them in an unused vlan. </li></ul><ul><li>Ensure DHCP attack prevention. </li></ul>
  15. 15. References & Links <ul><li>http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/sfblu_wp.pdf </li></ul><ul><li>http://www.terena.org/events/archive/tnc2003/programme/slides/s1c3.ppt </li></ul><ul><li>http://www.sanog.org/resources/sanog7/yusuf-L2-attack-mitigation.pdf </li></ul><ul><li>http://www.cisco.at/endkunden/pdf/Tkrewedl_abrauma_CISF_SW_L2_Sec_TK.pdf </li></ul><ul><li>http://www.seanconvery.com/SEC-2002.pdf </li></ul><ul><li>http://www.cisco.com/warp/public/cc/pd/si/casi/ca6000/prodlit/vlnwp_wp.pdf </li></ul><ul><li>http://seclab.cs.ucdavis.edu/papers/Marro_masters_thesis.pdf </li></ul><ul><li>http://www.blackhat.com/presentations/bh-usa-01/MikeBeekey/bh-usa-01-Mike-Beekey.ppt </li></ul><ul><li>http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf </li></ul><ul><li>http://monkey.org/~dugsong/dsniff </li></ul><ul><li>http://www.yersinia.net/ </li></ul>

×