How can an attacker hop between VLANs, and how do you stop it?
Show the answer
Say this first
Two ways. Switch spoofing: the attacker's machine speaks DTP to a port left in a dynamic mode, a trunk
forms, and the attacker can send into and receive from every allowed VLAN. Double tagging: from the
native VLAN, the attacker sends a frame with two tags; the first switch strips the outer tag as native
and forwards it, and the next switch delivers it into the inner VLAN. Static access ports with
nonegotiate stop the first; an unused or tagged native VLAN stops the second.
Go deeper
Switch spoofing
Tools such as Yersinia send DTP desirable frames. If the access port is dynamic auto or desirable, it becomes a trunk. The attacker then tags frames with any VLAN ID and sees broadcast and flooded traffic from all allowed VLANs.
Double tagging
- The attacker is in VLAN 1, which is also the native VLAN on the uplink trunk.
- They send a frame with an outer tag of 1 and an inner tag of 20.
- SW1 accepts the frame into VLAN 1 and consumes the outer tag. VLAN 1 is native on the trunk, so SW1 sends the frame out without adding a tag, which leaves the inner tag 20 as the first tag on the wire.
- SW2 reads tag 20 and delivers the frame into VLAN 20.
It is one way only: replies go back with a single tag and never reach the attacker's VLAN. It is still enough for a crafted UDP attack.
Hardening
interface range GigabitEthernet1/0/1 - 44
switchport mode access
switchport nonegotiate
switchport access vlan 10
interface range GigabitEthernet1/0/45 - 46
description unused
switchport mode access
switchport access vlan 998
shutdown
interface GigabitEthernet1/0/48
switchport mode trunk
switchport nonegotiate
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,30
!
vlan dot1q tag nativeVLAN 999 has no access ports; VLAN 998 is a parking lot for unused ports.
They will ask next
Why is double tagging one way only?
The victim's reply travels with a single tag for its own VLAN. Nothing strips or adds a tag to move it back into the attacker's VLAN, so the reply never arrives.
Traps
- Changing the native VLAN number but leaving user ports in that VLAN. The attacker just needs to be in the native VLAN.