A large number of common threats need to be considered when securing a network, but a frequently overlooked area is the security of the LAN. When people think about security, often they’re thinking specifically of the layers above Layer 2, but there’s no reason to limit a security plan to these upper layers. A good security plan should account for all layers, from Layer 1 through Layer 7. This article takes a look at some of the most common Layer 2 attacks and how they operate.
OSI Was Built to Allow Different Layers to Work
Without the Knowledge of Each Other
Unfortunately this means if one layer is hacked, communications are compromised
without the other layers being aware of the problem
Security is only as strong as the weakest link
When it comes to networking, layer 2 can be a VERY weak link
Spanning Tree Protocol (STP) Attacks
The Spanning Tree Protocol (STP) is used on LAN-switched networks. Its primary function is removing potential loops within the network. Without STP, Layer 2 LANs simply would stop functioning, because the loops created within the network would flood the switches with traffic. The optimized operation and configuration of STP ensures that the LAN remains stable and that traffic takes the most optimized path through the network. If an attacker inserts a new STP device onto the network and attempts to alter the operation of STP, this attack has the potential to affect how traffic flows through the LAN, greatly affecting the usability and security of the traffic flowing through the network.
Address Resolution Protocol (ARP) Attacks
The Address Resolution Protocol (ARP) is used by all network devices that connect to an Ethernet network. Devices use ARP to find the Layer 2 Ethernet address (MAC) for a destination device, using only the target device’s known IP address. ARP by itself is inherently insecure because devices are told to trust the answers they receive. So if device A requests the MAC address of device B, and device C answers in place of device B, device A will send all traffic destined for device B to device C. If device C was attempting to run a transparent attack, it would then forward the traffic to device B while recording the data from the traffic; this is called a man-in-the-middle (MITM) attack.
Media Access Control (MAC) Spoofing
In a Media Access Control (MAC) spoofing attack, one device on a network uses the MAC address of another device. The goal of the attacker is to redirect all of the traffic for the targeted device to the attacking device. If you think about a telephone network, this attack is the equivalent of someone taking over your phone number and having future calls rerouted to them. This rerouting could be used to disguise one device as another for multiple purposes, including to act as that device (possibly a server), or to perform a denial-of-service attack on that device.
Dynamic Host Configuration Protocol (DHCP) Spoofing
Similar to the other types of spoofing attacks, Dynamic Host Configuration Protocol (DHCP) spoofing involves an attacker pretending to be someone else; in this case, acting as the legitimate DHCP server. Since DHCP is used on most networks to provide addressing and other information to clients, losing control of this part of the network can be dangerous.
In DHCP spoofing attacks, the attacker places a rogue DHCP server on the network. As clients are turned on and request an address, the server with the fastest response is used. If the device receives a response from the rogue server first, the rogue server can assign any address as well as control which device it uses as a gateway. A well-designed attack can funnel traffic from local hosts to a rogue server that logs all traffic and then forwards the traffic out to the “correct” gateway; to the device, this action would be almost transparent. Thus, the attacker can steal information almost invisibly.
Virtual LAN (VLAN) Hopping
There are two types of virtual LAN (VLAN) hopping attacks, but the goal is the same—sending traffic to another VLAN:
Basic VLAN Hopping Attack
Are you looking to break into the exciting field of cybersecurity? Join our 5-day CompTIA Security+ Bootcamp Training and build your cybersecurity knowledge and skills.
Become a certified ethical hacker! Our 5-day CEH Bootcamp is unlike other strictly theoretical training, you will be immersed in interactive sessions with hands-on labs after each topic. You can explore your newly gained knowledge right away in your classroom by pentesting, hacking and securing your own systems. Learn more