bugtraq - Re: Tool for Identifying Rogue Linksys Routers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 26 Aug 2005 20:13:24 -0400
From: Tony Rall <trall@...aden.ibm.com>
To: Bugtraq <bugtraq@...urityfocus.com>,
	"Full-Disclosure (E-mail)" <full-disclosure@...ts.netsys.com>
Subject: Re: Tool for Identifying Rogue Linksys Routers

On Thursday, 2005-08-25 at 11:48 MST, Martin Mkrtchian 
<dotsecure@...il.com> wrote:
> We are migrating from Lucent QIP to MetaIP for DHCP services and so
> far we have had two issues when MetaIP has been implemented for  VLAN
> that has an unauthorized Linksys router giving out IP addresses.
> 
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?

First you say you have a problem with rogue dhcp servers (don't we all?), 
then you way you're looking for routers.

For the rogue dhcp server problem, there are 2 types of this problem, but 
unfortunately the solutions I've found aren't quite as specific to dhcp as 
I would like.

Blocking at layer 3 (router) is relatively easy - you can block traffic to 
68/udp except from your official dhcp servers.

Blocking at layer 2 is harder.  Here is a suggestion for doing it on Cisco 
switches (which might not work on low end equipment - haven't tried that - 
the switches must support vlan filtering):

Using vlan filtering, define that rogue traffic is dropped and logged; all 
other traffic is forwarded:

vlan access-map dhcpmap 10
 match ip address rogue_dhcp
 action drop log
vlan access-map dhcpmap 20
 match ip address any_host
 action forward
exit

An access list that matches all traffic:

ip access-list standard any_host
 remark Provide a match (permit) for all traffic
 permit any
exit

An access list that matches rogue dhcp traffic.  (With Cisco's strange 
vlan access mechanism, it requires that we appear to be blocking the valid 
traffic and allowing the bad stuff.  But, in conjunction with the 
access-map, just the opposite occurs.)

ip access-list extended rogue_dhcp
 remark Provide a match (permit) for dhcp responses from rogue servers
 deny   udp host 10.1.32.21 any eq bootpc    ! these are my official dhcp 
servers
 deny   udp host 10.1.32.22 any eq bootpc    ! likewise
 deny   udp 10.1.0.0 0.0.252.7 any eq bootpc   ! my routers, that might be 
relaying legitimate dhcp
 permit udp any any eq bootpc                ! the match that will catch 
the rogues
 deny   ip any any                               ! don't catch anything 
else
exit

Apply this setup to the vlans supported by my dhcp servers:

vlan filter dhcpmap vlan-list 64-128,136-140,146,232

The way this works it could result in blocking some traffic that you 
really don't  want to (for example, if any of your users employ PIXIE to 
load some of their machines).  If so, you will need to add the addresses 
of those server machines to the filter as though they were official dhcp 
servers - so that their bootpc traffic is not blocked.

Tony Rall