bugtraq - Re: STP mitm attack idea

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 28 Apr 2010 18:20:55 +0200
From: Jann Horn <jannhorn@...glemail.com>
To: bugtraq@...urityfocus.com
Subject: Re: STP mitm attack idea

Am Dienstag, den 27.04.2010, 19:55 +0200 schrieb Przemyslaw Borkowski:
> Second scenario:
> 1. Station C and station D starts to send frames to break link beetween switch 1 and switch 2, and announce non existing connection and switch from C port on switch 1 to D port on switch 2
> 
> A ---- switch 1 --X-- switch 2 ----- B
>           |              |
>           |              |
>           C  --no conn-- D
> 2. Station A sends frame to B
> 3. Frame is forwarded to C station
> 4. Station C stores frame in memory
> 5. After equal timing station C and station D repair link beetween switch 1 and 2
> 6. station C resends stored packet to station D (ie in tunnel or encapsulated in ip packet)
> 7. stations C and D break link beetween switches 1 and 2
> 8. station D sends transmitted packet to station B

If you had a WLAN-link, you could simplify that a lot - as far as I
understand, you are able to make the switches redirect the traffic to
your machines.
Anyway, this attack sounds like something a good switch can easily
prevent by having a list of "STP trusted ports" or something like that.
Doesn't that exist?

Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)