Question

T + 125% Media Comment Shape Text Chart Insert Table Add Page Zoom View Each student chooses one attack; then do some research, describe: How the attack works What the prevention (or detection or mitigation) method is for this attack 1. Layer 2 attacks or lower layer attacks VLAN hopping, Spanning-Tree Attack Jamming Attack Vulnerability on Neighbor Discovery Protocol (NDP) GARP Attacks/ARP poisoning Private VLAN Proxy Attack MAC flooding, MAC spoofing and ARP flood attacks Authentication/Association flood attack and de-authentication/ disassociation flood attack 2. Layer 3 (or Router) attacks DNS Rebinding attack Route Table Poisoning Cross-Site Request Forgery (CSRF) Max Sequence Number Attack via OSPF BGP Router Attacks RIP Attack Heap and Stack Overflow Attacks DHCP Starvation/ DHCP Consumption Attack/DHCP Exhaustion Attack Peer-to-Peer and Smurf attacks Routing Table Modification and Denial of Service Attacks Denial of Service Attacks- SYN Floods OSPF and XSS attacks 16

Answer 1

LAYER 2 ATTACKS

VLAN HOPPING:

VLAN hopping is one of the primary VLAN based attack used by hackers to infiltrate network security.

   In this attacker is connected to an access port can gain an access to network to network traffic from another VLANs.

These attacks mainly are conducted in the Dynamic trunking protocol. Also in some cases the attacks are targeted to the trunking encapsulation protocol.

Using VLAN hopping attack, an attacker can sniff network traffic from another VLAN using a sniffer or send traffic from one VLAN to another VLAN.

VLAN hopping can be used to steal password and other sensitive information from specific network subscribers.

VLAN hopping can also be used to modify, corrupt or delete data install spyware or other malware programs, and propagate viruses, worms and trojans throughout the network.

There are two different types of VLAN hopping attacks.

Switch spoofing attack

Double tagging attack.

Switch spoofing attack:

the attacker will send DTP packets and tries to negotiate a trunk with the switch, this is possible when you use the default “dynamic auto” or “dynamic desirable” switchport mode. Once you have a trunk to your computer, you will have access to all VLANs. This is basically a misconfiguration since you should never configure your interfaces to use the dynamic switchport modes.

Double tagging attack:

In this form of VLAN hopping, the attacker tries to send data from one switch to another by sending frames with two 802.1Q headers – one for the victim switch and the other for the attacking switch. The victim switch accepts the frame because it thinks it is supposed to receive the incoming data. The target switch then forwards the frame to the destination based on the VLAN identifier in the second 802.1q header.

Consequences of VLAN Hopping

VLAN hopping can disable any security measures users may have in place on the device which maps routes between the VLAN's. Hackers use VLAN hopping to capture sensitive information such as bank account details and passwords from targeted network subscribers. VLAN hopping is also used by some attackers to corrupt, modify, or delete data from the end user's computer. Another intended use of VLAN hopping is to propagate viruses, worms, Trojan horses, and other malicious programs such as malware.

Preventing VLAN Hopping:

VLAN hopping can be prevented to some extend by turning off the auto trunking feature of all the switches which do not require trunking and by following specific recommendations from switch suppliers on VLAN security.

You should never use the default VLAN either because VLAN hopping is much more easily accomplished from the default VLAN. A good security measure is to assign all your used interfaces to some VLAN and never using any default VLAN, (typically VLAN 1) for anything