Creative VLAN Hopping Attacks
This section is a catchall for various methods to achieve VLAN hopping when trunking is turned off on th port to which the attacker is connected. As these methods are discovered, they tend to be closed by the vendors affected. One tricky attack will take some time to stop on all devices. You might wish to refer t( the previous section on 802.1q if you need more information. The attack works by sending frames with two 802.1q tags instead of one. The attack requires the use of two switches, and the attacker and victir must be on separate switches. In addition, the attacker and the trunk port must have the same 802.1q native VLAN. The attack works like this:
1. The attacker sends a double-tagged 802.1q frame to the switch. The outer header has the VLAN tag of the attacker and trunk port. (For the purposes of this attack, let's assume VLAN 10.) The inner ti is the victim VLAN, VLAN 20.
2. The frame arrives on the switch, which looks at the first 4-byte 802.1q tag. The switch sees that the frame is destined for VLAN 10 and sends it out on all VLAN 10 ports (including the trunk) since ther is no CAM table entry. Remember that, at this point, the second VLAN tag is still intact and was nev inspected by the first switch.
3. The frame arrives at the second switch but has no knowledge that it was supposed to be for VLAN ] (Remember, native VLAN traffic is not tagged by the sending switch as specified in the 802.1q spec.
4. The second switch looks at only the 802.1q tag (the former inner tag that the attacker sent) and se the frame is destined for VLAN 20 (the victim VLAN).
5. The second switch sends the packet on to the victim port or floods it, depending on whether there i: an existing CAM table entry for the victim host.
Figure 6-7 illustrates the attack. It is important to note that this attack is only unidirectional and works only when the attacker and trunk port have the same native VLAN.
Figure 6-7. Double-Tagged 802.1q VLAN Hopping Attack
Figure 6-7. Double-Tagged 802.1q VLAN Hopping Attack
This attack is easy to stop if you follow the best practice that native VLANs for trunk ports should never used anywhere else on the switch. For switches to prevent this attack, they must look further into the packet to determine whether more than one VLAN tag is attached to a given frame.
Unfortunately, the application-specific integrated circuits (ASICs) that are used by most switches are on hardware optimized to look for one tag and then to switch the frame. The problem of performance versi security rears its ugly head again.
You might be wondering why the switch is accepting tagged frames on a port that isn't trunking in the first place. Refer to the section on 802.1q, where we discussed that part of the 802.1q tag is the 802.1p tag for frame priority (QoS). So, to support 802.1p, the switch must support 802.1q frames.
Continue reading here: ARP Considerations
Was this article helpful?