Please enable JavaScript.

Coggle requires JavaScript to display documents.

CHAPTER 5 SWITCH SECURITY : 5.1 EXPLAIN LAN SECURITY CONCEPTS IN SWITCH…

- - - - This is an image of the functions of each OSI layers.
        
        Layer 1 (Physical) : Physical links
        
        Layer 2 (Data Link) : Ethernet Frames
        
        Layer 3 (Network) : IP Addresses
        
        Layer 4 (Transport) : Protocol/Ports
        
        Layer 5 (Session) : HTTP, HTTPS, POP3, IMAP, SSL, SSH,...
        
        Layer 6 (Presentation) : HTTP, HTTPS, POP3, IMAP, SSL, SSH,...
        
        Layer 7 (Application) : HTTP, HTTPS, POP3, IMAP, SSL, SSH,...
        
        Network administrators routinely implement security solutions to protect the elements in layer 3 up through layer 7
        
        VPN/firewalls/IPS devices etc to protect the elements
        
        BUT!!! If layer 2 is compromised then all of the above layer also affected
    - - Security is only as strong as the weakest link in the system and layer 2 is considered as the weak link
      - Now, because of BYOD and more sophisticated attacks, LANs become more vulnerable to penetration
      - Switch Attack Categories :
        
        MAC Table Attacks - MAC address flooding attacks
        
        VLAN Attacks - VLAN hopping & VLAN double-tagging attacks
        
        DHCP Attacks - DHCP starvation & DHCP spoofing attacks
        
        ARP Attacks - ARP spoofing & ARP poisoning attacks
        
        Address Spoofing Attacks - MAC address & IP address spoofing attacks
        
        STP Attacks - Spanning Tree Protocol manipulation attacks
    - - Switch Attack Mitigation Technique :
        
        Port Security - can prevent many types of attacks including MAC address flooding attacks and DHCP starvation attacks
        
        DHCP snooping - prevent DHCP starvation & DHCP spoofing attacks
        
        Dynamic ARP Inspection (DAI) - can prevent ARP spoofing & ARP poisoning attacks
        
        IP Source Guard (IPSG) - prevents MAC & IP address spoofing attacks
      - the management protocols need to be secured also if we want effective solutions
        
        Recommended strategies to strengthen the securities of the management protocols :
        
        always use secure variants of management protocols such as SSH/ Secure Copy Protocol (SCP)/ Secure FTP (SFTP)/ Secure Socket Layer/Transport Layer Security (SSL/TLS)
        
        consider using out-of-band management network to manage devices
        
        use a dedicated management VLAN where only management traffic resides
        
        use ACLs to filter unwanted access
- - - - A threat actor configures the host to spoof 802.1Q and DTP signaling to trunk with the connecting switch.
        
        The threat actor can send and receive traffic on any VLAN, effectively hopping between VLANs.
  - - - step 1 : The threat actor sends a double-tagged 802.1Q frame to the switch.
        
        has the VLAN tag of the threat actor which same as the native VLAN of the trunk port.
      - step 2 : The frame arrives on the first switch which looks at the first 4-byte 802.1Q tag.
        
        forwards the packet out all native VLAN ports after stripping the VLAN tag.
      - step 3 : The frame arrives at the second switch which has no knowledge that it supposed to be for the native VLAN.
        
        native VLAN traffic is not tagged.
        
        the second switch looks only at the inner 802.1Q tag that the threat actor inserted & sees that the frame is destinied the taret VLAN.
    - - it only works when the attacker is connected to aport residing in the same VLAN as the native VLAN of the trunk port.
    - - VLAN hopping & VLAN double-tagging attacks can be prevented by implementing the following guidelines :
        
        Disable auto trunking on trunk links.
        
        Use native VLAN for trunk links.
        
        Disable trunking on all access ports.
  - - - DHCP uses DORA for as the mesage exchange between client and server.
    - - DHCP Starvation Attack
        
        The goal of this attack is to create a DoS for connecting clients.
        
        Require an attack tool (Gobbler).
      - DHCP Spoofing Attack
        
        A rouge DHCP server is connected to the network & provides false IP configuration paramteres ro legitimate clients
        
        A rouge server can provide a variety of misleading information incuding the following :
        
        wrong deafult gateway
        
        wrong DNS server
        
        wrong IP address
  - - - Mitigated by implementing BPDU Guard on all access ports.
  - - - To mitigate the exploitation, limit the use of CDP on devices or ports. ( with disable CDP on edge ports that connect to untrusted devices.)
        
        To disable and enable CDP :
        
        ON DEVICE
        
        Disable CDP :
        
        no cdp run
        
        Enable CDP :
        
        cdp run
        
        (global configuration command).
        
        ON PORT
        
        Disable CDP :
        
        no cdp enable
        
        Enable CDP :
        
        cdp enable
        
        (interface configuration command.)
  - - - many tools available on the internet to create ARP man-in-the-middle attacks.
        
        IPv6 uses ICMPv6 Neighbor Discovery Protocol for Layer 2 address resolution.
        
        includes strategies to mitigate Neighbor Advertisement spoofing
  - - - the switch overwrites the current MAC table entry
      - assigns the MAC address to the new port.
        
        forwards frame destinied for the target host to the attacking host.
        
        the switch will correct the error,realigning the MAC address to the original port.
        
        create a program that will constantly send frames to the switch to stop the switch.
      - no security mechanism at Layer 2 which allows a switch to verify the source of MAC addresses
        
        IP and MAC address spoofing can be mitigated by implementing IP Source Guard.
- - - - a dangerous tools that can create a MAC table overflow attack very quickly
        
        also can affect other connected Layer 2 switches other than the local switch
        
        it also can flood MAC address table of other connected switches