1 / 15

Layer 2 Security

Honeynet Project Canadian Chapter Sami Guirguis Sami.kamel@gmail.com February 2008. Layer 2 Security. The Threat.

shelby
Télécharger la présentation

Layer 2 Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Toronto Info Sec - Layer 2 security Honeynet Project Canadian Chapter Sami Guirguis Sami.kamel@gmail.com February 2008 Layer 2 Security

  2. Toronto Info Sec - Layer 2 security The Threat • The OSI model was built to allow different layers to work without knowledge of each other, and that means that if a layer is compromised the other layers will not be aware “Domino effect”. • i.e layer 3 will not be aware if layer 2 is attacked. • Facts: • A layer2 attack is hard to achieve from the outside world, but never underestimate the local attacker. the attacker may not be so local after all—backdoors and wireless hacking allow remote crackers. • 99% of enterprise network ports are open(according to FBI report). • 59% Insider attacks by employees. • Being in the LAN layer 2 is considered trusted by Security Ops and firewall/IDS/IPS technologies offer limited capabilities at layer 2. • More Broadband providers deploy access networks based exclusively on L2 for many reasons, worth mentioning the convergence time of RSTP is faster compared to OSPF and EIGRP, Ethernet interfaces are cheaper (Ex Wireless, Metro Ethernet), ease of connection to customer network. • The effect of a DOS attack on on L2 takes another dimension than in WAN as the BW is considerably higher.

  3. Toronto Info Sec - Layer 2 security Data link layer technologiesBackground about technologies affected by the following attacks • Switch operation (Unicast, Broadcast/Multicast)‏ • Content-Addressable Memory (CAM) (ARP)table address-learning process. • VLAN,Cisco Inter switch Link (ISL), IEEE 802.1q. • Spanning tree Protocol(STP). • Rapid STP (RSTP). • Bridge Protocol Data Unit (BPDU).

  4. Toronto Info Sec - Layer 2 security CAM table overflow. VLAN hopping. Spanning Tree Protocol (STP) manipulation. MAC Spoofing(ARP poisoning). Private VLAN. DHCP attacks. Attacks techniques achieve Access, DOS, MITM. Attack Types

  5. Toronto Info Sec - Layer 2 security MAC Flood • Dsniff (macof) can generate 155,000 mac/min. • CAM tables size (cisco switches 16kb to 128kb),(100 to over 100,000 entries) hence even if the CAM table refresh time is short it will not be short enough. (default in cisco is 5min).‏ • After the CAM table is flooded the switch enters a fail-open mode acting as a hub, forwarding traffic to all ports making sniffing easier, or achieving a DOS attack consuming switch processing power. • This attack can flood adjacent switches as well. • It is limited to the attacker VLAN. • MAC flood mitigation • Limit amount of MAC addresses to be learned / port. • Static mac addresses configuration (not scalable but most secure).

  6. Toronto Info Sec - Layer 2 security VLAN Hopping • A malicious user on a VLAN trying to send packets to a system on a different VLAN. • Two main techniques are: • Switch Spoofing. • 802.1q Double Tagging.

  7. Toronto Info Sec - Layer 2 security Switch Spoofing • Trunk ports have access to all VLANs traffic • When the malicious user can spoof as a switch with ISL or 802.1q he will have access to all traffic, as trunk ports have access to all VLANs. • Port must be set to Trunk or to Auto (basically negotiates trunking),Or has DTP Dynamic trunking protocol on. • Tools • Yersinia can spoof many protocols STP,ISL,802.1q,CDP,DTP,DHCP,HSRP,VTP. • Some Unix operating systems come with “brctl” a bridging utility STP capable. • Mitigation • Disable unused Ports, set them to access mode. Disable unused Ports, set them to access mode, disable Dynamic trunking protocol on access ports(DTP allows the port to negotiate the trunking protocol with the other device )‏

  8. Toronto Info Sec - Layer 2 security Double tagging 802.1q • Attacker send a double encapsulated frame 802.1q. The first tag will get stripped off by the switch to which we are connected, and the packet will get forwarded to the next switch. However, a remaining tag contains a different VLAN to which the packet will be sent. • Works even if trunk port is set to off. • Limitations • Unidirectional. (Not really as it can be DOS / turned Bidirectional using WEPWedgie ) • There must be multi-switches and obviously trunking. • Attacker and Trunk must have same native VLAN. • Does not work on ISL that does not have the concept of native VLAN. • Attacker cannot push data to a target on the same switch.

  9. Toronto Info Sec - Layer 2 security STP Manipulation • Spanning Tree Protocol (STP) exists to prevent Layer 2 loops from being formed when switches or bridges are interconnected via multiple paths for redundancy reasons. • Switches exchange BPDU messages to • Elect a root bridge for all LANs, and calculate the shortest path to it. • Elect a per LAN designated bridge. • Designated bridge sends a BPDU in case of topology change up the tree to the root bridge that forwards it to other LANs.

  10. Toronto Info Sec - Layer 2 security STP/RSTP Pitfalls Lack of authentication in BPDU messages If a malicious user impersonates a switch and participates in the STP process, can create a DOS by consequently sending topology change BPDU messages all the switches will continuously recompute the algorithm. The user can also participate in the STP process by impersonating the root bridge and redirect traffic/sniff it. Mitigation Enable root guard on cisco equipment that enforces the placement of the root bridge in the network, or BPDU guard on users ports to disable the use of priority zero and hence becoming a root bridge.

  11. Toronto Info Sec - Layer 2 security MAC Spoof • ARP works by sending broadcasts to find the MAC address corresponding to an IP. • The attacker overrides the CAM table entry so the switch forwards the packets destined for the host to the attacker. This allows the hacker to play MITM between two hosts or between the gateway and all hosts. • The attacker takes advantage of the GARP Gratuitous ARPs (unsolicited ARP replies). • Tools Ettercap and Arpspoof, they send less than an ARP per second so they are not detected by switch security features. • This attack is limited to the VLAN, cannot Hop vlans. Mitigation • The DHCP messages are used to build an IP to MAC binding table containing (MAC, IP, lease time, binding type, VLAN number). The DHCP snooping feature builds the binding table and the Dynamic ARP inspection verifies the messages based on the binding table. • Use Arpwatch an open source that generates a log of IP-MAC pairings with timestamps. • Hard code static arp entries on OS “arp -s <ip> <mac>”

  12. Toronto Info Sec - Layer 2 security Private VLAN • PVLAN restricts communication between ports in the same VLAN by assigning ports roles (Isolated, Promiscuous and Community). • The Proxy attack sends a packet with his IP/MAC and destination IP of target system and MAC of the router. (since switches are only MAC aware and routers only IP aware). • This attack is unidirectional as the PVLAN will block the victim response. Mitigation • Configure access list on the router

  13. Toronto Info Sec - Layer 2 security DHCP Starvation • Broadcasts of DHCP requests with spoofed MAC addresses to exhaust the DHCP server IP pool. • According to RFC 2131 a hacker can introduce a rogue DHCP server assigning clients IP addresses and acting as MITM while a DHCP server is already running. Mitigation • DHCP authentication - RFC 3118 • No known usage by any commercial or private implementation since its adoption in 2001, most probably due to non scalable key distribution.

  14. Toronto Info Sec - Layer 2 security Configuration best practice • Use dedicated VPAN for all trunk ports. • Avoid using VLAN 1. • Deploy port security. • Set users ports to non trunking. • Use ARP security options. • Use BPDU guard, Root guard. • Use PVLANs. • Disable CDP. • Disable unused ports and put them in an unused vlan. • Ensure DHCP attack prevention.

  15. Toronto Info Sec - Layer 2 security References & Links • http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/sfblu_wp.pdf • http://www.terena.org/events/archive/tnc2003/programme/slides/s1c3.ppt • http://www.sanog.org/resources/sanog7/yusuf-L2-attack-mitigation.pdf • http://www.cisco.at/endkunden/pdf/Tkrewedl_abrauma_CISF_SW_L2_Sec_TK.pdf • http://www.seanconvery.com/SEC-2002.pdf • http://www.cisco.com/warp/public/cc/pd/si/casi/ca6000/prodlit/vlnwp_wp.pdf • http://seclab.cs.ucdavis.edu/papers/Marro_masters_thesis.pdf • http://www.blackhat.com/presentations/bh-usa-01/MikeBeekey/bh-usa-01-Mike-Beekey.ppt • http://i.cmpnet.com/gocsi/db_area/pdfs/fbi/FBI2004.pdf • http://monkey.org/~dugsong/dsniff • http://www.yersinia.net/

More Related