Exploiting First Hop Protocols to Own the Network. Rocket City TakeDownCon Paul Coggin Senior Principal Cyber Security

Transcription

1 Exploiting First Hop Protocols to Own the Network Rocket City TakeDownCon 2015 Paul Coggin Senior Principal Cyber Security V## Goes Here 1

2 OSI and TCP/IP Model OSI Model TCP/IP Model 7 Application Presentation Session Transport Network Own the Network Application Transport Internet 2 1 Data Link Physical Frame Header Network Interface 2

3 ARP Poisoning User 1 IP MAC Router IP MAC Corporate Server IP User 1 ARP Cache Poisoned Router ARP Cache Poisoned Cain and Abel Ettercap User 3 IP MAC Gratuitous ARP User 1 traffic to server redirected to User MAC Gratuitous ARP Return traffic redirected to User MAC

4 ARP Poisoning Dynamic ARP Inspection IP Source Inspection SNMP Alerts and Syslog monitoring 4

5 Rogue DHCP Server Unauthorized DHCP Server Allocates bad DNS server or default gateway Denial of service by exhausting the leases in the DHCP scope Tools Yersinia, Gobbler Mitigation Limit MAC addresses per interface VACL s to block DHCP UDP 68 DHCP snooping Trusted\Untrusted (mitigates client hardware address change) DHCP Client Corporate DHCP Server Rogue User 5

6 Lawful Intercept Identify Physical Source of Traffic DHCP request DHCP request with sub ID in Option identifier (RFC 3046) DHCP response with IP address MAC A Ethernet Access Domain MAC B MAC C DSL CPE ADSL modem IP DSLAM PE-AGG L3VPN-PE ISP DHCP Server Example Enterprise Network DHCP with Option 82 Support DHCP Option 82 provides the DSLAM and Switch Name and the Physical Interface That Requested a DHCP IP Address 6

7 Spanning Tree Protocol - Architecture Root STP 802.1d, MSTP, PVSTP+, RSTP STP calculates loop-free topology BPDU sent every 2 seconds Priority Default priority Lowest priority elected Root 7

8 Spanning Tree Protocol Attack Root BPDU w/ priority 0 Root Bridge MITM, DoS (Yersinia) Implement Root Guard, BPDU Guard, Syslog, SNMPv3 Alerts 8

9 VLAN Hopping Dynamic Trunking Protocol VLAN 60 VLAN 60 VLAN 50 DTP Trunk VLAN 50 VLAN 40 Spoof DTP to look like switch (Yersinia) Dynamic Trunk Protocol (DTP) Modes : Auto, On, Off, Desirable, Non-negotiate IP Phones, Wireless Access Points All VLANs are trunked by default Native VLAN (untagged); Default Native VLAN 1 and required by DTP Yersinia or other packet crafting tools Disable trunking on interfaces where not in use Specify VLANs to be allowed on trunk interfaces Do not use Native VLAN 1 9

10 VLAN Hopping Double VLAN Tag VLAN 60 Switch strips off first VLAN ID VLAN 40 Tag Frame VLAN 60 Untagged Frame VLAN 50 VLAN 10, VLAN 40 VLAN 10 Yersinia VLAN 50 VLAN 40 No two-way communication. Frames sent to target with no response to sender. Craft Frames with double encapsulated frames VLAN trunking is not required in this scenario Disable AUTO\DYNAMIC NEGOTIATION! Don t use native VLAN 1. Use tagged mode for native VLAN x on trunks Disable interfaces not in use 10

11 CAM Table Overflow Attack Node 2 to Node 4 Node 2 to Node 4 Node 1 Node 3 Node 2 to Node 4 Node 2 Yersinia, Macof, DSNIFF Node 4 Switch CAM table exploited resulting in switch VLAN operating like a shared Ethernet hub Attack may cause multiple switches to fallback to shared Ethernet behavior Implement port security to limit MACs per interface, SNMP Traps 11

12 VLAN Trunking Protocol (VTP) VLANs are added\removed on VTP Server VLAN modifications propagated to VTP Clients Common VTP Domain name and password Same Native VLAN on Trunk Sync to latest changes VTP Server Transparent (VTP DB rev 0) 802.1Q Trunk VTP Client 802.1Q Trunk 802.1Q Trunk VTP Client VTP Client 802.1Q Trunk 12

13 VLAN Trunking Protocol (VTP) - Security Existing network running default VTP settings Switches sync to higher rev VTP DB resulting in VLAN config being lost!! Everyone has a current VLAN.DAT backup right?? Configure a password for VTP Domain (NOT Cisco.SanFran.) Delete VLAN.DAT before connecting a new switch Change the native VLAN to something other than 1 VTP Server 802.1Q Trunk Switch with higher rev of VTP DB added Transparent (VTP DB rev 0) 802.1Q Trunk 802.1Q Trunk VTP Client 802.1Q Trunk VTP Client VTP Client 13

14 Broadcast Storms Broadcast storm propagated across VLAN VLAN 20 VLAN 20 VLAN 20 VLAN 20 VLAN 20 VLAN 20 Rogue Insider Misconfigured Application Failed NIC Traffic Storm Control limits unicast, multicast, broadcast traffic to a % of port BW Not enabled on interfaces by default (add to template configuration for port security) Traffic that exceeds configured threshold will be dropped Violations can be configured to be shutdown or send a SNMP Trap(recommend v3) 14

15 First Hop Redundancy Protocols Active router Virtual router V Backup router Multicast protocol Priority elects role MD5, clear, no authentication Protocol Hacking Tools GSN3 SCAPY Colasoft Packet Builder Many others (Remember to enable IP forwarding) V Rogue Insider Global Load Balancing Protocol (GLBP) Hot Standby Router Protocol (HSRP) Virtual Redundant Router Protocol (VRRP) 15

16 HSRP MITM Packet Analysis HSRP Password Clear Text 16

17 FHRP Crafted HSRP Packets Routers Crafted HSRP coup packet with higher priority Rogue Insider 17

18 IPv6 Neighbor Discover Protocol Filter on IPv6 or Ethernet Type 0x86DD to Identify IPv6 Packets IPv6 uses multicast \ No more broadcast 18

19 IPv6 SLACC MITM IPv6 Neighbor Discovery Protocol (NDP) (Think ARP for IPv6) IPv6 MITM Tools - Chiron, - Evil FOCA - THC Parasite6 - SCAPY - Colasoft Packet Builder Man-in-the-Middle Mitigations - RAguard x - Private VLANs - IPv6 port security - Source\Destination Guard - SeND (encrypt NDP) Rogue Insider Sending RA s Windows Linux Mac Default - Hosts Send ICMPv6 Router Solicitation 19

20 IPv6 Network Discovery Spoofing MITM IPv6 Neighbor Discovery Protocol (NDP) (Think ARP for IPv6) IPv6 MITM Tools - Chiron - Evil FOCA - THC Parasite6 - SCAPY - Colasoft Packet Builder Network Discovery Spoofing - MITM (ARP Spoofing equivalent for IPv6) Mitigations - Source\Destination Guard x - Private VLANs - IPv6 port security - NDP Spoofing - DHCP Snooping - Source\Destination Guard - SeND (encrypt NDP) Windows Mac Rogue Insider Linux 20

21 DMZ Layer 2 Security DMZ - Typically single VLAN - Open trusts Inside VLAN - DMZ to Internal AD integ. - Pivot from DMZ to Internal network *NIX w/nis(ad Integ.) WWW Internet Secure DMZ Trusts - PVLAN - VACL - Separate Virtual or Physical Int w/ ACL s - Develop a network traffic matrix to define required network traffic flows DNS Internal Network SMTP SharePoint Database DNS Active Directory 21

22 Layer 2 Secure Visualization and Instrumentation In-band Monitoring EPC SPAN RSPAN ERSPAN Netflow NOC \ SOC TAP/Sniffer Out-of-bound Network Whitelist the Layer 2 Network Trust Relationships Whitelist Trusted Information Flows in Monitoring Secure Control, Management, Data Planes 22

23 Layer 2 Security Recommendations Cisco TrustSec Identity Services Engine 802.1x with 2 factor authentication Private VLANs VLAN Access Control Lists (VACL) Root Guard BPDU Guard Secure VTP protocol Disable VLAN trunking where not in use Storm Control IPv6 Port Security Dynamic ARP Inspection IP Source Inspection DHCP Option 82 Logging Secure DHCP Trusts Layer 2 Secure Visualization and Instrumentation 23

24 References LAN Switch Security What Hackers Know About Your Switches, Eric Vyncke, Christopher Paggen, Cisco Press Enno ERNW Papers and Resources, Ivan PepeInjak Papers and Resources, hwp:// IPv6 Security, ScoW Hogg and Eric Vyncke, Cisco Press IPv6 Security, ScoW Hogg, hwp:// content/uploads/2014/10/ipv6- Hacker- Halted- The- Hacker- Code- Angels- vs- Demons.pdf The Prac\ce of Network Security Monitoring, Ricard Bejtlich, No Starch Press Router Security Strategies Securing IP Network Traffic Planes, Gregg Schudel, David J. Smith, Cisco Press hwps:// hwp://docwiki.cisco.com/wiki/fhs hwp:// 2011/sample- pcap- files hwp:// xml/ios/ipapp_drp/configura\on/12-4/dp book.html hwp:// hwp:// hwp:// hwp:// hwp:// lists/ html hwp://monkey.org/~dugsong/dsniff/ hwps:// hwps:// Cisco%20Port%20Security.pdf hwp://iase.disa.mil/s\gs/net_perimeter/network- infrastructure/pages/index.aspx 24

25 Ques&ons? 25