Switch spoofing
In a switch spoofing attack, an attacking host
imitates a trunking switch by speaking the tagging and trunking
protocols (e.g. Multiple VLAN Registration Protocol, IEEE 802.1Q,
Dynamic Trunking Protocol) used in maintaining a VLAN. Traffic for
multiple VLANs is then accessible to the attacking host.
Mitigation
Switch spoofing can only be exploited when interfaces
are set to negotiate a trunk. To prevent this attack on Cisco IOS, use
one of the following methods:
- Ensure that ports are not set to negotiate trunks automatically by disabling DTP:
Switch(config-if)# switchport nonegotiate
- Ensure that ports that are not meant to be trunks are explicitly configured as access ports
Switch(config-if)# switchport mode access Double tagging
In a
double tagging attack, an attacking host connected on a 802.1q
interface prepends two VLAN tags to packets that it transmits. The
packet (which corresponds to the VLAN that the attacker is really a
member of) is forwarded without the first tag, because it is the
native VLAN. The second (false) tag is then visible to the second
switch that the packet encounters. This false VLAN tag indicates that
the packet is destined for a target host on a second switch. The
packet is then sent to the target host as though it originated on the
target VLAN bypassing the network mechanisms that logically isolate
VLANs from one another. However, this attack allows to send packets
toward the second switch, but possible answers are not forwarded to
the attacking host.
Mitigation
Double Tagging can only be exploited when switches
use "Native VLANs".[2] Ports with a specific access VLAN (the native
VLAN) don't apply a VLAN tag when sending frames, allowing the
attacker's fake VLAN tag to be read by the next switch.
Double Tagging can be mitigated by either one of the following actions
(Incl. IOS example):
Simply do not put any hosts on VLAN 1 (The default VLAN). i.e., assign
an access VLAN other than VLAN 1 to every access port
Switch(config-if)# switchport access vlan 2
Change the native VLAN on
all trunk ports to an unused VLAN ID.
Switch(config-if)# switchport trunk native vlan 999
Explicit tagging of the native VLAN on all trunk
ports. Must be configured on all switches in network autonomy.
Switch(config)# vlan dot1q tag native
Example
As an example of a
double tagging attack, consider a secure web server on a VLAN called
VLAN2. Hosts on VLAN2 are allowed access to the web server; hosts from
outside VLAN2 are blocked by layer 3 filters. An attacking host on a
separate VLAN, called VLAN1(Native), creates a specially formed packet
to attack the web server. It places a header tagging the packet as
belonging to VLAN2 under the header tagging the packet as belonging to
VLAN1. When the packet is sent, the switch sees the default VLAN1
header and removes it and forwards the packet. The next switch sees
the VLAN2 header and puts the packet in VLAN2. The packet thus arrives
at the target server as though it was sent from another host on VLAN2,
ignoring any layer 3 filtering that might be in place.