bugtraq - Re: STP mitm attack idea

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100429172132.GA3991@mrph.org>
Date: Thu, 29 Apr 2010 13:21:32 -0400
From: Ivan Jager <aij+@...h.org>
To: "Jason T. Masker" <jason@...ker.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: STP mitm attack idea

On Wed, Apr 28, 2010 at 05:26:09PM -0400, Jason T. Masker scribbled thusly:
> Best practice is to implement layer 2 security mechanisms which would
> identify these ports as "access" ports and shut them down if any STP
> traffic was received through these interfaces. On Cisco equipment,
> this is known as BPDU guard.
> http://www.cisco.com/en/US/customer/tech/tk389/tk621/technologies_tech_note09186a008009482f.shtml

I don't have an account with Cisco any more, but why would
shutting down the port be the right thing to do? CMU does that,
and it means you have to be very careful when plugging in a
higher-end switch, which was recently a problem for Computer
Club. It seems like simply ignoring STP packets from that port
would be just as effective and much less disruptive.

Ivan