Layer 2 Attacks

Overview

A large number of common threats need to be considered when securing a network, but a frequently overlooked area is the security of the LAN. When people think about security, often they’re thinking specifically of the layers above Layer 2, but there’s no reason to limit a security plan to these upper layers. A good security plan should account for all layers, from Layer 1 through Layer 7. This article takes a look at some of the most common Layer 2 attacks and how they operate.

OSI Was Built to Allow Different Layers to Work
Without the Knowledge of Each Other

Unfortunately this means if one layer is hacked, communications are compromised
without the other layers being aware of the problem
Security is only as strong as the weakest link
When it comes to networking, layer 2 can be a VERY weak link

Spanning Tree Protocol (STP) Attacks

The Spanning Tree Protocol (STP) is used on LAN-switched networks. Its primary function is removing potential loops within the network. Without STP, Layer 2 LANs simply would stop functioning, because the loops created within the network would flood the switches with traffic. The optimized operation and configuration of STP ensures that the LAN remains stable and that traffic takes the most optimized path through the network. If an attacker inserts a new STP device onto the network and attempts to alter the operation of STP, this attack has the potential to affect how traffic flows through the LAN, greatly affecting the usability and security of the traffic flowing through the network.

Address Resolution Protocol (ARP) Attacks

The Address Resolution Protocol (ARP) is used by all network devices that connect to an Ethernet network. Devices use ARP to find the Layer 2 Ethernet address (MAC) for a destination device, using only the target device’s known IP address. ARP by itself is inherently insecure because devices are told to trust the answers they receive. So if device A requests the MAC address of device B, and device C answers in place of device B, device A will send all traffic destined for device B to device C. If device C was attempting to run a transparent attack, it would then forward the traffic to device B while recording the data from the traffic; this is called a man-in-the-middle (MITM) attack.

Media Access Control (MAC) Spoofing

In a Media Access Control (MAC) spoofing attack, one device on a network uses the MAC address of another device. The goal of the attacker is to redirect all of the traffic for the targeted device to the attacking device. If you think about a telephone network, this attack is the equivalent of someone taking over your phone number and having future calls rerouted to them. This rerouting could be used to disguise one device as another for multiple purposes, including to act as that device (possibly a server), or to perform a denial-of-service attack on that device.

Dynamic Host Configuration Protocol (DHCP) Spoofing

Similar to the other types of spoofing attacks, Dynamic Host Configuration Protocol (DHCP) spoofing involves an attacker pretending to be someone else; in this case, acting as the legitimate DHCP server. Since DHCP is used on most networks to provide addressing and other information to clients, losing control of this part of the network can be dangerous.

In DHCP spoofing attacks, the attacker places a rogue DHCP server on the network. As clients are turned on and request an address, the server with the fastest response is used. If the device receives a response from the rogue server first, the rogue server can assign any address as well as control which device it uses as a gateway. A well-designed attack can funnel traffic from local hosts to a rogue server that logs all traffic and then forwards the traffic out to the “correct” gateway; to the device, this action would be almost transparent. Thus, the attacker can steal information almost invisibly.

Virtual LAN (VLAN) Hopping

There are two types of virtual LAN (VLAN) hopping attacks, but the goal is the same—sending traffic to another VLAN:

Switch spoofing. In this attack, the attacker attempts to connect a rogue switch into the network and then set up a trunk. If the attack is successful, traffic from multiple VLANs can be sent to and through the rogue switch, enabling the attacker to view and potentially manipulate the traffic. This attack relies on the default behavior of some switches that support dynamic trunking: If dynamic trunking is disabled, and all non-trunk interfaces are configured not to become trunked, this attack is mitigated.
Double tagging. To understand double tagging, you need some VLAN basics. Virtual LANs provide security on LANs by isolating traffic into separate traffic lanes. Traffic from all VLANs (except for the native VLAN) is “tagged” with an IEEE 802.1q tag when the traffic is sent over trunks between switches. These tags can be nested, which means that traffic can have multiple attached tags. If a frame with two nested tags is received on a trunking interface, and the first tag (the outermost tag) is the same as the tag for the native VLAN for that interface, some switches will remove that outer tag and send the traffic along to the VLAN of the second tag. This design allows an attacker to send traffic from one VLAN into another VLAN (hopping), which is supposed to be impossible without a Layer 3 device.

Basic VLAN Hopping Attack

Product categories

Sources: CMU, NIST, Standford

Are you looking to break into the exciting field of cybersecurity? Join our 5-day CompTIA Security+ Bootcamp Training and build your cybersecurity knowledge and skills.

Become a certified ethical hacker! Our 5-day CEH Bootcamp is unlike other strictly theoretical training, you will be immersed in interactive sessions with hands-on labs after each topic. You can explore your newly gained knowledge right away in your classroom by pentesting, hacking and securing your own systems. Learn more