Layer 2 Security and Attacks

This tutorial will teach you some of the important security measures to secure your network for layer 2 attacks by following some of the best security practices.

Justification for this Survey

- Security is only as strong as the weakest link
- Layer 2 attacks are timeworn but still relevant in today’s networking environment
- Crime and security survey show different types of attacks for the year of 2008. CSI / FBI  surveys also show that different types of attacks could target routers and switches

Figure-1

Executive Summary

A large number of networks exist in Karachi with either no or limited protection that can be easily compromised. Basic configuration errors like use default manufacturer device settings, mechanisms and default configuration, expose risk of access of such networks through these defaults settings using publicly available information.

There was scope for enhancing the security of many of the wired and wireless networks observed during the survey. Of the total networks sampled, around 57% appeared to be unprotected i.e. not having VLAN’s in network, Auto-Trunking working default settings. Around 75% of organizations are using Manageable switches and most of these use Cisco catalyst.

We found Cisco is most popular brand in our survey, Most of people are using Cisco switches in his infrastructure and 3Com is 2nd choose of users and reaming are using Linksys, Baynet and Baylan.

Figure-2 : Switch Venders Summary Graph

Most of the users are using manageable switches.

Figure-3 : Manageable or Non –Manageable Summary Graph

Survey Observations

Of the 25 networks seen, 67% appeared to be unprotected i.e. without VLAN. 8% were using low level of protection i.e SSH, STP, Auto-Trunking. Balance 25% networks were using the more secure Protected Layer 2 security.

This makes 75% of the observed networks being relatively easy to do VLAN hopping attack and it could be easy to attack in same subnet.

Figure-3: VLAN Summary Graph

Figure-4 : Auto-Trunking Graph Summary

From our survey data nomenclature VTP broadcast storm can be generated in 32% collected data networks.

Figure-5 : VTP Summary Graph

This makes 72% of the observed networks being relatively easy to do Spanning Tree Root Hijack attack. I could be easy in flat network.

Figre-6 : Spanning Tree Protocol Summary Graph

In other security aspect, We found most of the users are not using remote access for switches, in this only 16% users are using secure remote access remaining are using unencrypted remote access.

Figure 7 : Switch Remote Access Summery Graph

As per our observation most of the organization are not applying protection at Layer 2 level.

Figure-8 : 802.1x Protection at Layer 2

Conclusion

The rapid growth in wire and wireless networks without commensurate increase in layer 2 network security awareness, both at Small and Enterprise business, is indeed a growing concern. At the same time, there is significant scope for enhancing security our unsecured networks. The major risks that one might be exposed to include:

• Unauthorized users may gain access to unsecured network and use network resources. This will not only issue in the network but they can also generate Layer 2 level Attacks.

In keeping with our overall objective to increase the security at layer 2 networks deployed in Karachi, we have included Layer 2 Network Security Good Practices in Annexure I.

Annexure I

MAC Flooding Attack Mitigation

•Port Security
- Allow you to specify MAC addresses for each port, or to learn a certain number of MAC addresses per port.
- Upon detection of an invalid MAC block only the offending MAC or just shut down the port.

•Smart CAM table
- Never overwrite existing entries.
- Only time-out inactive entries.
- Active hosts will never be overwritten.

•Speak first
- Deviation from learning bridge: never flood.
- Requires a hosts to send traffic first before receiving.

VLAN Hopping Attack Mitigation

•Use recent switches.
•Disable auto-trunking.
•Never put host in the trunk native VLAN.
•Put unused ports in an unused VLAN.

Spanning Tree Attacks Mitigation

•Disable STP
(It is not needed in loop free topologies).

•BPDU Guard
Disables ports upon detection of a BPDU message on the port.

•Root Guard
Disables ports that would become the root bridge due to their BPDU advertisement.

References

http://www.cisco.com

http://www.sans.org

http://www.juniper.net

http://www.securityfocus.com

(No Ratings Yet)

 Loading ...