Currently studying for a CCNA Security, I have been taught to never use the native VLAN for security purposes. This old discussion from Cisco forum states it very clearly:
You should never use the default VLAN either because VLAN hopping is much more easily accomplished from the default VLAN.
However, from a practical point-of-view, I am not able to precisely pin-point what actual threat is being addressed.
My thoughts are the following:
The attacker being located on the native VLAN, maybe he can directly inject 802.1q packets which will be forwarded without modification by the first switch (as coming from a native VLAN) and upcoming switches will consider these packets as legitimate packets coming from any VLAN chosen by the attacker.
This would have indeed made VLAN hopping attacks "much more easy". However, this does not work since the first switch rightly considers it as abnormal to receive 802.1q packets on an access port and therefore drops such packets.
An attacker being located on a non-native VLAN manages to turn a switch access port into a trunk one. To send traffic to the native VLAN he will just have to change his IP address (a single command) instead of enabling VLAN on his network interface (four commands), saving three commands.
I obviously consider this at most as a very marginal gain...
When digging in the history, I thought I read somewhere old recommendations stating that 802.1q injection could require a compatible network card and specific drivers. Such requirements would indeed limit attacker's ability to inject 802.1q packets and make native VLAN exploitation much more practical in the previous scenario.
However this does not seem to be a real limitation nowadays and VLAN configuration commands are a common part of Linux (at least) network configuration commands.
Could we consider this advice of not using the native VLANs to be outdated and kept only for historical and configuration sanity purposes, even-though this practice does not address any particular threat anymore? Or is there a concrete scenario where VLAN hopping indeed becomes much more easy because of the native VLAN being used?