[Security Brief] - P15 - VLAN Hopping Attacks

What is VLAN Hopping?

VLAN hopping is a network attack that allows malicious actors to gain unauthorized access to traffic on VLANs that they should not have access to. This attack exploits vulnerabilities in VLAN configurations, potentially compromising the integrity and confidentiality of data within a network [1].

There are two primary methods of VLAN hopping:

1. Switch Spoofing: In this attack, the attacker impersonates a trunking switch by manipulating protocols like Dynamic Trunking Protocol (DTP). The goal is to negotiate a trunk connection with a legitimate switch, which would then allow the attacker to gain access to traffic from multiple VLANs [2].
   Key points:
   - The attacker's device pretends to be a switch requesting a trunk connection.
   - It exploits the automatic trunking features of some switches.
   - If successful, it gives the attacker access to traffic from all VLANs allowed on the trunk.
2. Double Tagging: This method involves the attacker sending packets with two 802.1Q VLAN tags. It takes advantage of how some switches process these tags [2].
   Key points:
   - The attacker adds two VLAN tags to a frame.
   - The first (outer) tag matches the attacker's VLAN.
   - The second (inner) tag is for the target VLAN.
   - Many switches remove only the outer tag, allowing the packet to be forwarded to the target VLAN.
   - This is typically a one-way attack, as return traffic cannot be double-tagged.

The Impact of VLAN Hopping Attacks

While specific statistics on VLAN hopping attacks are limited due to their nature as a "second stage" attack, the potential impact is significant:

• Unauthorized access to sensitive data and resources across different network segments
• Potential for data theft, manipulation, or deletion
• Ability to install malware or propagate other threats throughout the network
• Disruption of network availability and integrity

Preventing VLAN Hopping Attacks

To protect your network against VLAN hopping, implement the following best practices:

1. Disable DTP and use static trunking:

   Switch(config-if)# switchport mode trunk
   Switch(config-if)# switchport nonegotiate

   This configuration prevents switch spoofing attacks by disabling Dynamic Trunking Protocol (DTP) and manually setting the port as a trunk. The switchport nonegotiate command ensures that the port won't respond to DTP negotiations, preventing an attacker from tricking the switch into forming a trunk link.
2. Configure unused ports as access ports and disable them:

   Switch(config-if)# switchport mode access
   Switch(config-if)# shutdown

   This practice reduces the attack surface by ensuring that unused ports can't be exploited. Setting them as access ports prevents them from becoming trunk ports, and shutting them down adds an extra layer of security.

3. Use a dedicated, unused VLAN ID for the native VLAN on trunk ports:

   Switch(config-if)# switchport trunk native vlan 999

   Using an unused VLAN ID (like 999) for the native VLAN on trunk ports helps prevent double-tagging attacks. This is because traffic on the native VLAN is typically untagged, and using an unused VLAN ID ensures that no actual data traffic is sent untagged.

4. Enable explicit tagging of the native VLAN on all trunk ports:

   Switch(config-if)# switchport port-security
   Switch(config-if)# switchport port-security maximum 1

   This command forces the switch to tag all traffic, including traffic on the native VLAN. This helps prevent VLAN hopping attacks that rely on manipulating untagged traffic.

5. Implement port security to limit MAC addresses on each port:
   

   Switch(config-if)# switchport port-security
   Switch(config-if)# switchport port-security maximum 1

   Port security limits the number of MAC addresses that can be learned on a port. By setting the maximum to 1, you ensure that only one device can connect to each port, preventing attackers from connecting additional devices or spoofing MAC addresses.

6. Use private VLANs for additional isolation where necessary:
   Private VLANs provide an extra isolation layer within a regular VLAN by restricting communication between ports. This can be useful for isolating servers, separating customer networks in multi-tenant environments, or restricting communication between IoT devices [3].
7. Regularly monitor network traffic for suspicious activities:
   Implement network monitoring tools to analyze traffic patterns and detect anomalies. Set up alerts for unusual traffic spikes or connections, and use NetFlow or sFlow to collect traffic statistics [3].
8. Implement 802.1X authentication for enhanced access control:
   802.1X provides port-based network access control to prevent unauthorized devices from connecting to the network. Configure RADIUS server for authentication and enable 802.1X globally and on interfaces [3].

Conclusion

VLAN hopping attacks pose a significant threat to network security, potentially compromising the integrity and confidentiality of your organization's data. By understanding these attacks and implementing the recommended prevention measures, you can significantly enhance your network's resilience against VLAN hopping and other related threats. Remember, network security is an ongoing process. Regularly review and update your VLAN configurations, conduct security audits, and stay informed about emerging threats to keep your network protected. By combining proper VLAN security measures with robust monitoring and access control, you can create a layered defense that significantly reduces the risk of successful VLAN hopping attacks.

1. https://www.packetlabs.net/posts/what-is-vlan-hopping/

2. https://networklessons.com/cisco/ccnp-switch/vlan-hopping

3. https://www.n-able.com/it/blog/vlan-hopping-security

------------------------------------------
[Security Brief] - P14 - Hardware Security Module
[Security Brief] - P13 - Birthday Attack