Many organizations use VLANs to separate the network
into different parts.
This may be for organizational reasons.
It might also be for security reasons.
So you might have a VLAN for the network engineering team,
a VLAN for shipping and receiving,
and a separate VLAN for the accounting department.
This means if someone in the accounting department
is accessing the network, then they
have access to all of the other devices that
are on the accounting VLAN.
And best practice is that you would only
have access to the devices that are on your local VLAN.
But there are some techniques that might allow someone
to hop to another VLAN.
Obviously, this is something that should not be happening,
and we want to be sure that we're
protecting against somebody who's able to access
a VLAN that's not their own.
There are two primary methods that people are using
to hop between VLANs this way.
One is called switch spoofing, and the other one
is double tagging.
Many trunks allow you to set up an automatic configuration
mode.
This is called trunk negotiation.
And it allows you to plug in a device to a switch,
and that switch will determine if the device you plugged in
is a normal access device-- such as a laptop or a computer--
or if the device you're plugging in might be another switch.
This automatic configuration doesn't
have any type of authentication associated with it.
So if you wanted to pretend that you were a switch,
you could use specialized software
and connect to a switch that had this automatic configuration,
and instead of the switch thinking of you
as a laptop or a desktop, it would then
consider that you were another switch on the network.
At that point, you would negotiate the trunks
that were required across this particular link,
just as if you were connecting two switches to each other.
And now you're able to send information to any of the VLANs
that would be supported over that trunk connection.
This switch spoofing would effectively give anyone access
to VLANs that were supported on that remote switch.
This is why a switch administrator would normally
disable this particular automatic trunk negotiation.
The administrator should instead manually define
which interfaces on a switch are for a trunk,
and which interfaces on a switch are for access devices.
Normally, when a frame is sent across a trunk connection,
there's a tag that's added to that frame.
On the other side, that tag is evaluated and removed,
and that data is sent to the correct VLAN on the other side.
One way to get around this functionality
is to include two tags with a particular frame going
over VLAN.
And with double tagging, we're able to use the native VLAN
of a particular switch to gain access to a VLAN
that normally we would not have access to.
This double tagging attack uses two different switches.
The first switch removes the first tag
associated with the frame.
And the second switch removes the second tag
associated with the frame, and forwards that data
to the separate VLAN.
This also means that this particular kind of attack
can only work in one direction.
There's no way to put two tags on the return frame.
So whenever you're sending information
using this double tagging attack,
you're sending it without ever receiving a response back
from the other device.
This limits some of the things that you
might be able to do with this attack,
but it certainly could be used for something
like a denial of service.
One way to avoid a double tagging attack
is not to allow someone access to the native VLAN.
You would change the native VLAN ID and force
anyone going over the native VLAN to use tagging.
Here's how this double tagging works.
We have an attacker's computer, and a victim computer.
You notice the attackers on VLAN 10,
and the victim device is on VLAN 20.
Normally, these two devices would not
be able to communicate directly with each other.
They would have to go through a router at the very least.
But by using double tagging, we can
hop through both of these switches
and have our data end up on a different VLAN.
Here's the frame that we're going to send.
It's an Ethernet frame that has two tags inside of it.
One tag for VLAN 10, and one tag for VLAN 20.
That frame will be sent to the first switch,
and that switch is going to evaluate the first tag
associated in this frame.
That will be the tag for VLAN 10.
It removes that tag, and that frame that's leftover
still has a tag for VLAN 20.
So it will send it across this trunk to VLAN 20,
where this switch will perform the normal removal of the tag
and send this data down to the victim's workstation.
Obviously, any data that comes from VLAN 10
should not suddenly appear on VLAN 20.
This double tagging attack allows this attacking device
to send information directly to this victim.