LAN Security and Network Attacks

1From the switching lectures5 min

Every one of these six sentences is, today, the starting point of an attack. Not because they are wrongly implemented, but because they are implemented exactly as they were conceived - in an age when the local network was, implicitly, a space of trust.

Learning outcomes

• Classify an attack by its purpose and say which mechanism it exploits
• Explain the mechanics of CAM overflow, ARP poisoning and VLAN hopping
• Describe how a single cable can bring down an entire network through STP
• Configure port security, DHCP snooping and Dynamic ARP Inspection
• Close VLAN hopping through three settings
• Explain what a salt does and, above all, what it does not do
• Apply a complete hardening list to an access switch

2Three families of attack8 min

3Reconnaissance9 min

Before any serious attack comes the gathering of information: which IP addresses are alive, what services run on them, in what version, what operating systems, and whom the users of the network trust.

The same tools are used daily by administrators too - the difference is the authorisation, not the instrument.

Look at the third command. Two different IP addresses with the same MAC address is the anomaly that betrays a man-in-the-middle attack - and it is the cheapest check you can make on a suspect host.

What a firewall can do against reconnaissance: block the answer to ICMP echo, close vulnerable ports, forbid connections being initiated from outside, limit the rate of requests. What it cannot do: stop an attacker already inside the local network. Hence the rest of the lecture.

4Denial-of-service attacks9 min

The smurf attack

TCP SYN flood

We met it in lecture 8: the attacker sends thousands of SYN segments with forged source addresses, and the server allocates an entry in the queue of half-open connections for each. When the queue fills, legitimate connections are refused.

Defences: SYN cookies, which let the server allocate nothing until confirmation; limiting the number of half-open connections per source; and, as always, monitoring the traffic under normal conditions - an anomaly is noticed only if you know what normal looks like.

5CAM overflow10 min

This is the attack that directly exploits the mechanism from lecture 3. A switch's memory is finite - typically between 8,000 and 32,000 entries - so the CAM table can be filled. And when it fills, the switch can no longer learn new addresses and floods every unknown frame on every port. In other words: it becomes a hub again.

Go back to the CAM table simulator from lecture 3 and watch what happens with every frame: the switch learns only from the source address and floods any unknown destination. The attack does nothing but push those two rules to their limit.

SW(config)# interface fastEthernet 0/5
SW(config-if)# switchport mode access
SW(config-if)# switchport port-security
SW(config-if)# switchport port-security maximum 2
SW(config-if)# switchport port-security mac-address sticky
SW(config-if)# switchport port-security violation restrict
SW(config-if)# switchport port-security aging time 60

SW# show port-security interface fastEthernet 0/5
SW# show mac address-table count

6Man-in-the-middle through ARP poisoning11 min

ARP, as we studied it in lecture 5, has a property that today seems inconceivable: it authenticates nothing. What is more, most implementations accept an ARP reply even if they never sent a request - a mechanism called gratuitous ARP, useful for announcing an address change, but exploitable.

! 1. the switch learns which IP address each port received, through DHCP
SW(config)# ip dhcp snooping
SW(config)# ip dhcp snooping vlan 10,20
SW(config)# interface gigabitEthernet 0/1
SW(config-if)# ip dhcp snooping trust

! 2. on the basis of that record, every ARP message is checked
SW(config)# ip arp inspection vlan 10,20
SW(config)# interface gigabitEthernet 0/1
SW(config-if)# ip arp inspection trust

! 3. for hosts with a static address, the record is written by hand
SW(config)# arp access-list SERVERS
SW(config-arp-nacl)# permit ip host 192.168.1.50 mac host 000c.2911.2233
SW(config)# ip arp inspection filter SERVERS vlan 10

SW# show ip dhcp snooping binding
SW# show ip arp inspection statistics

7VLAN hopping11 min

We built VLANs precisely in order to isolate departments. There are two techniques by which the isolation can be got round - both exploiting default behaviours of switches.

Switch spoofing

Many Cisco switches have DTP (Dynamic Trunking Protocol) enabled by default, which automatically negotiates whether a port becomes access or trunk. An attacker can present themselves as a switch and negotiate a trunk. Once obtained, they can send and receive 802.1Q-tagged frames for any VLAN.

SW(config)# interface range fastEthernet 0/1 - 22
SW(config-if-range)# switchport mode access
SW(config-if-range)# switchport nonegotiate
SW(config-if-range)# switchport access vlan 10

! unused ports: shut down and moved into a dead VLAN
SW(config)# interface range fastEthernet 0/23 - 24
SW(config-if-range)# switchport access vlan 999
SW(config-if-range)# shutdown

Double tagging

The technique exploits the native VLAN, which we know from lecture 4 travels untagged over a trunk. It requires no special protocol on the attacker's side - only the ability to build a frame with two tags.

8Attacks against STP10 min

STP uses no form of authentication whatever: any device that sends BPDUs takes part in the root election. An attacker connected anywhere in the network can announce BPDUs with a very low Bridge ID and become the root bridge - at which point a considerable part of the traffic begins to pass through them.

Lower the priority of a switch to 0 in the simulator above and watch the whole topology reorganise itself around it. That is exactly what the attacker does - except that the switch with priority 0 is their laptop, under the desk.

1. The attacker connects to the switched network, with a single cable.
2. They announce BPDUs with priority 0, hence with the lowest possible BID.
3. STP reconverges; they become the root, and the port roles are recomputed around them.
4. Traffic between segments now passes through their machine, where it can be captured.

The denial-of-service variant is simpler still: the attacker changes their BID continually, forcing permanent recomputations. The ports never reach the forwarding state, and the network is, in practice, stopped - with one cable and no exploit at all.

! ports towards hosts: go straight into forwarding...
SW(config)# interface range fastEthernet 0/1 - 22
SW(config-if-range)# spanning-tree portfast

! ...and shut down if a BPDU appears from there
SW(config-if-range)# spanning-tree bpduguard enable

! the root is set explicitly, on the switch at the centre of the network
SW_CORE(config)# spanning-tree vlan 1-100 root primary

! ports towards switches that must not become the root
SW(config)# interface gigabitEthernet 0/2
SW(config-if)# spanning-tree guard root

! automatic reactivation of shut-down ports, after 5 minutes
SW(config)# errdisable recovery cause bpduguard
SW(config)# errdisable recovery interval 300

9Passwords, hashes and salt9 min

A rainbow table does not store every possible hash - that would be impossible - but the starting points of chains of hashes, from which the intermediate values are recomputed as needed. It is a classic memory-time trade-off, and public tables of thousands of gigabytes are available on the Internet.

The salt

A salt is a random segment, generated for each user and concatenated to the password before hashing. It is stored alongside the hash, in the clear - it is not secret and does not need to be.

trudy:$6$/tKy92iM$/.cIxbEX49qHpZt74D5L0W1vXO2fJuXjyXJnsT0.M...
#      ^   ^        ^
#      |   |        the hash itself
#      |   the salt, randomly generated
#      the algorithm: 6 = SHA-512

10The human factor and hostile code7 min

Social engineering

The most effective avenue of access is not technical. The attacker convinces a person that they are trustworthy - a colleague from IT, a supplier, a superior in a hurry - and obtains the information directly. The target usually has no technical background, wants to help, and does not realise the value of what they hold.

Social engineering bypasses any technical mechanism, however well configured. There is no port security for a telephone. The only real defence is periodic training of non-technical staff and the existence of clear procedures for unusual requests - for instance, the rule that a password is never given out over the telephone, whoever is calling.

Phishing is the industrialised version of the same idea: instead of one call, a million messages.

Hostile executable code

11The short list for hardening a switch8 min

Everything discussed above comes down to a few configurations that apply to any access switch, in any organisational network.

SW(config)# hostname SW1
SW(config)# ip domain-name networks.local
SW(config)# crypto key generate rsa modulus 2048
SW(config)# ip ssh version 2
SW(config)# username admin privilege 15 secret AStrongPassword
SW(config)# service password-encryption

SW(config)# access-list 20 permit 10.0.100.0 0.0.0.255
SW(config)# line vty 0 15
SW(config-line)# transport input ssh
SW(config-line)# login local
SW(config-line)# access-class 20 in
SW(config-line)# exec-timeout 5 0

12Common mistakes4 min

• "I put portfast on every port, towards switches included" A loop can form before STP reacts - and a layer 2 loop stops the network within seconds. PortFast only towards hosts, always with BPDU Guard alongside.
• "I enabled DAI, and now the servers with static addresses cannot communicate" DAI relies on the record built by DHCP snooping. A host that never used DHCP does not appear there. Add manual entries with arp access-list for the servers with fixed addresses.
• "I set port-security maximum 1 everywhere" An IP telephone with a PC behind it has two addresses; a bridged virtual machine adds more. Choose the maximum from what actually connects there. 2 or 3 is more realistic.
• "I left VLAN 1 as the native VLAN" It is the default value and, often, the very VLAN the hosts are in - the exact precondition of the double tagging attack. A dedicated, empty native VLAN, different from 1 and from any user VLAN.
• "I configured everything, but did not save" The sticky addresses and the whole configuration disappear at the first reboot. copy running-config startup-config. The same lesson as in lecture 6.
• "Port security with violation shutdown, and now half the ports are shut" A user who changes their laptop shuts the port, and reactivating it requires manual intervention. restrict for ordinary areas; errdisable recovery where you do use shutdown.
• "We have a firewall, so the internal network is safe" The firewall does not see the traffic between two hosts in the same VLAN. Defence in depth: segmentation, measures on the switch, end-to-end encryption.

13Summary and glossary5 min

14Self-check questions7 min

15Closing2 min

With this lecture the course comes to a close. We started, in lecture 1, from an electrical signal on a wire and the question of how a bit becomes a voltage. We have arrived at a local network segmented into VLANs, dynamically routed, filtered with access lists, translated on the way out, extended without wires and defended against the attacks from within it.

What is worth keeping, beyond the commands: almost every mechanism we studied was invented as the solution to a concrete problem, and almost every one later became somebody else's problem. The switch solved collisions and created CAM overflow. The VLAN solved broadcast and created VLAN hopping. NAT rescued IPv4 and broke peer-to-peer. There is no design decision without a cost - there are only decisions taken knowingly and decisions taken out of habit.

Laboratory 7 carries out, under control, three of the attacks from here and then closes their doors, one by one.

• Cisco - Catalyst Switch Security Configuration Guide: port security, DHCP snooping, DAI
• RFC 2827 / BCP 38 - ingress filtering against address spoofing
• RFC 3704 - ingress filtering for multihomed networks
• OWASP - resources on passwords, hashing and authentication
• The nmap and Wireshark documentation - for strictly authorised use