bugtraq - RE: STP mitm attack idea

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 30 Apr 2010 09:02:32 -0400
From: "Williams, Dan" <dwilliam@...don.ca>
To: <bugtraq@...urityfocus.com>
Subject: RE: STP mitm attack idea

-----Original Message-----
From: Ivan Jager [mailto:aij+@...h.org] 
Sent: Thursday, April 29, 2010 1:22 PM
To: Jason T. Masker
Cc: bugtraq@...urityfocus.com
Subject: Re: STP mitm attack idea

On Wed, Apr 28, 2010 at 05:26:09PM -0400, Jason T. Masker scribbled
thusly:
> Best practice is to implement layer 2 security mechanisms which would
> identify these ports as "access" ports and shut them down if any STP
> traffic was received through these interfaces. On Cisco equipment,
> this is known as BPDU guard.
>
http://www.cisco.com/en/US/customer/tech/tk389/tk621/technologies_tech_n
ote09186a008009482f.shtml

>I don't have an account with Cisco any more, but why would
>shutting down the port be the right thing to do? CMU does that,
>and it means you have to be very careful when plugging in a
>higher-end switch, which was recently a problem for Computer
>Club. It seems like simply ignoring STP packets from that port
>would be just as effective and much less disruptive.

>Ivan

Shutting down the port is useful for security in the way that it helps
prevent the type of attack that Xperience has described. When BPDU Guard
is implemented the port will be shut down if any Spanning Tree packets
are seen. It is risky turning off Spanning Tree as any loops in the
network will create a denial of service by causing broadcast traffic to
be sent out every port on the switch in a continuous loop. An
interesting thing to note is what happens if a cable is plugged into two
ports on a switch, essentially creating a loop. For this reason when
BPDU is implemented and a port comes up it will send out two Spanning
Tree packets. The opposing port sees these packets and shuts down. One
other feature of BPDU guard is that it can be configured to stay in an
error state for a specified period of time by using the "errdisable
recovery cause bpduguard" command. When configured using the "errdisable
recovery interval xxx" This allows the port to return to normal usage
after the error condition has been resolved. Another reason to implement
these features is that it prevents Access ports from "sharing" Spanning
Tree information and "leaking" the network topology. From a security
stand point it might be useful disabling CDP on Access ports as well.

Dan