Exploiting First Hop Protocols to Own the Network - Paul Coggin
•
2 likes•759 views
This talk will focus on how to exploit a network by targeting the various first hop protocols. Attack vectors for crafting custom packets as well a few of the available tools for layer 2 network protocols exploitation will be covered. Defensive mitigations and recommendations for adding secure visualization and instrumentation for layer 2 will be provided.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Exploiting First Hop Protocols to Own the Network - Paul Coggin
Similar to Exploiting First Hop Protocols to Own the Network - Paul Coggin (20)
More from EC-Council
More from EC-Council (20)
Recently uploaded
Recently uploaded (20)
Exploiting First Hop Protocols to Own the Network - Paul Coggin
- 1. UNCLASSIFIED V100230_Faint UNCLASSIFIED 1 UNCLASSIFIED0000-00-yymm Information Engineering Solutions www.dynetics.com 1V## Goes Here Exploiting First Hop Protocols to Own the Network Hacker Halted 2015 Paul Coggin Senior Principal Cyber Security Analyst @PaulCoggin
- 2. UNCLASSIFIED V100230_Faint UNCLASSIFIED 2 UNCLASSIFIED0000-00-yymm Information Engineering Solutions OSI and TCP/IP Model OSI Model 7 6 5 4 3 2 1 Application Presentation Session Transport Network Data Link Physical TCP/IP Model Network Interface Application Transport Internet Frame Header OwntheNetwork
- 3. UNCLASSIFIED V100230_Faint UNCLASSIFIED 3 UNCLASSIFIED0000-00-yymm Information Engineering Solutions ARP Poisoning Corporate Server IP 172.16.1.1 User 1 IP 192.168.1.2 MAC 2222.2222.2222 User 3 IP 192.168.1.3 MAC 3333.3333.3333 Router IP 192.168.1.1 MAC 1111.1111.1111 Gratuitous ARP – User 1 traffic to server redirected to User 3 172.16.1.1 MAC 3333.3333.3333 Gratuitous ARP – Return traffic redirected to User 3 192.168.1.2 MAC 3333.3333.3333 Cain and Abel Ettercap User 1 ARP Cache Poisoned Router ARP Cache Poisoned
- 4. UNCLASSIFIED V100230_Faint UNCLASSIFIED 4 UNCLASSIFIED0000-00-yymm Information Engineering Solutions ARP Poisoning • Dynamic ARP Inspection • IP Source Inspection • SNMP Alerts and Syslog monitoring
- 5. UNCLASSIFIED V100230_Faint UNCLASSIFIED 5 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Rogue DHCP Server DHCP Client Corporate DHCP Server Rogue User Unauthorized DHCP Server • Allocates bad DNS server or default gateway Denial of service by exhausting the leases in the DHCP scope • Tools – Yersinia, Gobbler Mitigation • Limit MAC addresses per interface • VACL’s to block DHCP UDP 68 • DHCP snooping TrustedUntrusted (mitigates client hardware address change)
- 6. UNCLASSIFIED V100230_Faint UNCLASSIFIED 6 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Lawful Intercept Identify Physical Source of Traffic DHCP with Option 82 Support Example Enterprise Network DHCP Option 82 provides the DSLAM and Switch Name and the Physical Interface That Requested a DHCP IP Address DHCP request DHCP response with IP address DHCP request with sub ID in Option identifier (RFC 3046) Ethernet Access Domain MAC B MAC C MAC A ISP DHCP ServerADSL modem IP DSLAM PE-AGG DSL CPE L3VPN-PE
- 7. UNCLASSIFIED V100230_Faint UNCLASSIFIED 7 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Spanning Tree Protocol - Architecture STP calculates loop-free topology BPDU sent every 2 seconds Priority 0 – 65535 Default priority – 32768 Lowest priority elected Root Root STP 802.1d, MSTP, PVSTP+ , RSTP
- 8. UNCLASSIFIED V100230_Faint UNCLASSIFIED 8 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Spanning Tree Protocol – Attack Implement Root Guard, BPDU Guard, Syslog, SNMPv3 Alerts Root Bridge MITM, DoS (Yersinia) BPDU w/ priority 0 Root
- 9. UNCLASSIFIED V100230_Faint UNCLASSIFIED 9 UNCLASSIFIED0000-00-yymm Information Engineering Solutions VLAN Hopping – Dynamic Trunking Protocol • Dynamic Trunk Protocol (DTP) Modes : Auto, On, Off, Desirable, Non-negotiate • IP Phones, Wireless Access Points • All VLANs are trunked by default • Native VLAN (untagged); Default Native VLAN 1 and required by DTP • Yersinia or other packet crafting tools • Disable trunking on interfaces where not in use • Specify VLANs to be allowed on trunk interfaces • Do not use Native VLAN 1 VLAN 50 VLAN 60 VLAN 50 VLAN 40 VLAN 60 DTP Trunk Spoof DTP to look like switch (Yersinia)
- 10. UNCLASSIFIED V100230_Faint UNCLASSIFIED 10 UNCLASSIFIED0000-00-yymm Information Engineering Solutions VLAN Hopping – Double VLAN Tag • No two-way communication. Frames sent to target with no response to sender. • Craft Frames with double encapsulated frames • VLAN trunking is not required in this scenario • Disable AUTODYNAMIC NEGOTIATION! • Don’t use native VLAN 1. Use tagged mode for native VLAN x on trunks • Disable interfaces not in use VLAN 50 VLAN 60 VLAN 50 VLAN 40 VLAN 60 VLAN 10 Yersinia VLAN 10, VLAN 40 VLAN 40 Tag Frame Untagged Frame Switch strips off first VLAN ID
- 11. UNCLASSIFIED V100230_Faint UNCLASSIFIED 11 UNCLASSIFIED0000-00-yymm Information Engineering Solutions CAM Table Overflow Attack Yersinia, Macof, DSNIFF Node 2 to Node 4 Node 2 to Node 4 Node 1 Node 2 Node 4 Node 3 Node 2 to Node 4 Switch CAM table exploited resulting in switch VLAN operating like a shared Ethernet hub Attack may cause multiple switches to fallback to shared Ethernet behavior Implement port security to limit MACs per interface, SNMP Traps
- 12. UNCLASSIFIED V100230_Faint UNCLASSIFIED 12 UNCLASSIFIED0000-00-yymm Information Engineering Solutions VLAN Trunking Protocol (VTP) VTP Server Transparent (VTP DB rev 0) VTP Client VTP Client 802.1Q Trunk 802.1Q Trunk 802.1Q Trunk • VLANs are addedremoved on VTP Server • VLAN modifications propagated to VTP Clients • Common VTP Domain name and password • Same Native VLAN on Trunk • Sync to latest changes VTP Client 802.1Q Trunk
- 13. UNCLASSIFIED V100230_Faint UNCLASSIFIED 13 UNCLASSIFIED0000-00-yymm Information Engineering Solutions VLAN Trunking Protocol (VTP) - Security VTP Server Transparent (VTP DB rev 0) VTP Client VTP Client 802.1Q Trunk 802.1Q Trunk 802.1Q Trunk • Existing network running default VTP settings • Switches sync to higher rev VTP DB resulting in VLAN config being lost!! • Everyone has a current VLAN.DAT backup right?? • Configure a password for VTP Domain (NOT Cisco….SanFran….) • Delete VLAN.DAT before connecting a new switch • Change the native VLAN to something other than 1 VTP Client 802.1Q Trunk Switch with higher rev of VTP DB added
- 14. UNCLASSIFIED V100230_Faint UNCLASSIFIED 14 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Broadcast Storms VLAN 20 VLAN 20 VLAN 20 VLAN 20 VLAN 20 Rogue Insider Misconfigured Application Failed NIC Broadcast storm propagated across VLAN VLAN 20 Traffic Storm Control limits unicast, multicast, broadcast traffic to a % of port BW • Not enabled on interfaces by default (add to template configuration for port security) • Traffic that exceeds configured threshold will be dropped • Violations can be configured to be shutdown or send a SNMP Trap(recommend v3)
- 15. UNCLASSIFIED V100230_Faint UNCLASSIFIED 15 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Protocol Hacking Tools GSN3 SCAPY Colasoft Packet Builder Many others… (Remember to enable IP forwarding) First Hop Redundancy Protocols Global Load Balancing Protocol (GLBP) Hot Standby Router Protocol (HSRP) Virtual Redundant Router Protocol (VRRP) Active router 192.168.1.1 Backup router 192.168.1.2Virtual router 192.168.1.3 192.168.1.50 Multicast protocol Priority elects role MD5, clear, no authentication V V Rogue Insider
- 16. UNCLASSIFIED V100230_Faint UNCLASSIFIED 16 UNCLASSIFIED0000-00-yymm Information Engineering Solutions HSRP MITM – Packet Analysis HSRP Password Clear Text
- 17. UNCLASSIFIED V100230_Faint UNCLASSIFIED 17 UNCLASSIFIED0000-00-yymm Information Engineering Solutions FHRP – Crafted HSRP Packets Routers Rogue Insider Crafted HSRP coup packet with higher priority
- 18. UNCLASSIFIED V100230_Faint UNCLASSIFIED 18 UNCLASSIFIED0000-00-yymm Information Engineering Solutions IPv6 Neighbor Discover Protocol Filter on IPv6 or Ethernet Type 0x86DD to Identify IPv6 Packets IPv6 uses multicast No more broadcast
- 19. UNCLASSIFIED V100230_Faint UNCLASSIFIED 19 UNCLASSIFIED0000-00-yymm Information Engineering Solutions IPv6 SLACC MITM IPv6 Neighbor Discovery Protocol (NDP) (Think ARP for IPv6) IPv6 MITM Tools - Chiron, - Evil FOCA - THC Parasite6 - SCAPY - Colasoft Packet Builder Windows Linux Mac Default - Hosts Send ICMPv6 Router Solicitation Rogue Insider Sending RA’s Man-in-the-Middle Mitigations - RAguard - 802.1x - Private VLANs - IPv6 port security - SourceDestination Guard - SeND (encrypt NDP)
- 20. UNCLASSIFIED V100230_Faint UNCLASSIFIED 20 UNCLASSIFIED0000-00-yymm Information Engineering Solutions IPv6 Network Discovery Spoofing MITM Windows Linux Mac Mitigations - SourceDestination Guard - 802.1x - Private VLANs - IPv6 port security - NDP Spoofing - DHCP Snooping - SourceDestination Guard - SeND (encrypt NDP) Rogue Insider Network Discovery Spoofing - MITM (ARP Spoofing equivalent for IPv6) IPv6 Neighbor Discovery Protocol (NDP) (Think ARP for IPv6) IPv6 MITM Tools - Chiron - Evil FOCA - THC Parasite6 - SCAPY - Colasoft Packet Builder
- 21. UNCLASSIFIED V100230_Faint UNCLASSIFIED 21 UNCLASSIFIED0000-00-yymm Information Engineering Solutions DMZ Layer 2 Security Secure DMZ Trusts - PVLAN - VACL - Separate Virtual or Physical Int w/ ACL’s - Develop a network traffic matrix to define required network traffic flows WWW DNS SMTP SharePoint DMZ - Typically single VLAN - Open trusts Inside VLAN - DMZ to Internal AD integ. - Pivot from DMZ to Internal network Internal Network Database Email DNS *NIX w/NIS(AD Integ.) Active Directory Internet
- 22. UNCLASSIFIED V100230_Faint UNCLASSIFIED 22 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Layer 2 – Secure Visualization and Instrumentation TAP/Sniffer NOC SOC Out-of-bound Network Whitelist the Layer 2 Network Trust Relationships Whitelist Trusted Information Flows in Monitoring Secure Control, Management, Data Planes In-band Monitoring EPC SPAN RSPAN ERSPAN Netflow
- 23. UNCLASSIFIED V100230_Faint UNCLASSIFIED 23 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Layer 2 Security Recommendations • Cisco TrustSec – Identity Services Engine • 802.1x with 2 factor authentication • Private VLANs • VLAN Access Control Lists (VACL) • Root Guard • BPDU Guard • Secure VTP protocol • Disable VLAN trunking where not in use • Storm Control • IPv6 Port Security • Dynamic ARP Inspection • IP Source Inspection • DHCP Option 82 Logging • Secure DHCP Trusts • Layer 2 Secure Visualization and Instrumentation
- 24. UNCLASSIFIED V100230_Faint UNCLASSIFIED 24 UNCLASSIFIED0000-00-yymm Information Engineering Solutions References LAN Switch Security – What Hackers Know About Your Switches, Eric Vyncke, Christopher Paggen, Cisco Press Enno Rey -‐ @Enno_Insinuator, @WEareTROOPERS , ERNW Papers and Resources ,www.ernw.de, www.insinuator.net Ivan PepeInjak -‐ @IOShints, Papers and Resources, hWp://www.ipspace.net IPv6 Security, ScoW Hogg and Eric Vyncke, Cisco Press IPv6 Security, ScoW Hogg, hWp://www.gtri.com/wp-‐content/uploads/2014/10/IPv6-‐Hacker-‐Halted-‐The-‐Hacker-‐Code-‐Angels-‐vs-‐Demons.pdf The Pracce of Network Security Monitoring, Ricard Bejtlich, No Starch Press Router Security Strategies Securing IP Network Traffic Planes, Gregg Schudel, David J. Smith, Cisco Press hWps://www.cisco.com/go/safe hWp://docwiki.cisco.com/wiki/FHS hWp://www.netopcs.com/blog/01-‐07-‐2011/sample-‐pcap-‐files hWp://www.cisco.com/c/en/us/td/docs/ios-‐xml/ios/ipapp_drp/configuraon/12-‐4/dp-‐12-‐4-‐book.html hWp://www.cisco.com/c/en/us/td/docs/soluons/Enterprise/Security/Baseline_Security/securebasebook/sec_chap8.html hWp://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-‐2SX/best/pracces/recommendaons.html hWp://www.cisco.com/c/en/us/td/docs/soluons/Enterprise/Security/Baseline_Security/securebasebook/sec_chap8.html hWp://www.cisco.com/web/about/security/intelligence/ipv6_first_hop.html hWp://www.cisco.com/c/en/us/support/docs/ip/access-‐lists/13608-‐21.html hWp://monkey.org/~dugsong/dsniff/ hWps://www.yersinia.net hWps://www.nsa.gov/ia/_files/factsheets/Factsheet-‐Cisco%20Port%20Security.pdf hWp://iase.disa.mil/sgs/net_perimeter/network-‐infrastructure/Pages/index.aspx
- 25. UNCLASSIFIED V100230_Faint UNCLASSIFIED 25 UNCLASSIFIED0000-00-yymm Information Engineering Solutions Ques&ons? h+p://www.dyne&cs.com/insights @PaulCoggin