WEBVTT

1
00:00.000 --> 00:00.150 align:middle line:84%


2
00:00.150 --> 00:02.100 align:middle line:90%
I'd like you to think
with me how simple it

3
00:02.100 --> 00:05.170 align:middle line:90%
is for someone to connect
to our physical networks.

4
00:05.170 --> 00:08.608 align:middle line:90%
So for this switch, if we have
physical access, we could boom!

5
00:08.608 --> 00:09.150 align:middle line:84%
Plug into it.

6
00:09.150 --> 00:11.820 align:middle line:90%
Now hopefully, we've got our
physical switches and gear

7
00:11.820 --> 00:14.350 align:middle line:90%
in locked-up closets that are
air conditioned and everything

8
00:14.350 --> 00:14.850 align:middle line:84%
else.

9
00:14.850 --> 00:16.392 align:middle line:90%
But it's still pretty
easy for a user

10
00:16.392 --> 00:19.645 align:middle line:90%
to connect because we have
RJ45 jacks in their offices,

11
00:19.645 --> 00:20.270 align:middle line:84%
in their cubes.

12
00:20.270 --> 00:21.780 align:middle line:84%
And all they do is they plug in.

13
00:21.780 --> 00:23.970 align:middle line:90%
Now the question
I have for us is,

14
00:23.970 --> 00:26.010 align:middle line:90%
what is connecting
to our network?

15
00:26.010 --> 00:29.230 align:middle line:90%
And that is why we need the
feature of port security.

16
00:29.230 --> 00:31.950 align:middle line:90%
So in this video, I'd like to
talk with you about what it is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.230 --> 00:31.950 align:middle line:90%
So in this video, I'd like to
talk with you about what it is

17
00:31.950 --> 00:34.200 align:middle line:84%
and why we need it.

18
00:34.200 --> 00:37.533 align:middle line:90%
I see three major
challenges with controlling

19
00:37.533 --> 00:38.700 align:middle line:84%
who is connecting to a port.

20
00:38.700 --> 00:42.060 align:middle line:90%
Number one, we just don't
know who exactly it is.

21
00:42.060 --> 00:45.210 align:middle line:90%
I mean, maybe it's Bob
today or Sally tomorrow.

22
00:45.210 --> 00:47.040 align:middle line:90%
Or maybe Bob comes in
with another device

23
00:47.040 --> 00:47.790 align:middle line:84%
that's not his PC.

24
00:47.790 --> 00:49.770 align:middle line:90%
And he plugs into the
jack in his office.

25
00:49.770 --> 00:52.500 align:middle line:90%
And we've got this thing
connected to our network.

26
00:52.500 --> 00:56.130 align:middle line:90%
So who or what is
connected is a problem.

27
00:56.130 --> 00:58.600 align:middle line:90%
If we're not sure what it,
then we can't control it.

28
00:58.600 --> 01:00.017 align:middle line:90%
Another challenge
is that we could
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.600 --> 01:00.017 align:middle line:90%
Another challenge
is that we could

29
01:00.017 --> 01:02.430 align:middle line:90%
have multiple devices
connecting on one port that

30
01:02.430 --> 01:03.693 align:middle line:84%
are not authorized.

31
01:03.693 --> 01:04.610 align:middle line:84%
And here's an example.

32
01:04.610 --> 01:07.220 align:middle line:90%
Bob decides he's going to bring
in some more devices to work.

33
01:07.220 --> 01:08.710 align:middle line:84%
And he wants them in his office.

34
01:08.710 --> 01:11.820 align:middle line:90%
So he disconnects his PC
from the network connection.

35
01:11.820 --> 01:14.190 align:middle line:90%
And instead, he puts
in his own switch,

36
01:14.190 --> 01:17.270 align:middle line:90%
which are very affordable for
a nonmanaged, simple switch.

37
01:17.270 --> 01:19.200 align:middle line:90%
So he bought it at Fry's
or some other store.

38
01:19.200 --> 01:19.920 align:middle line:84%
He brings in.

39
01:19.920 --> 01:22.170 align:middle line:90%
He connects his network
connection to the switch.

40
01:22.170 --> 01:24.150 align:middle line:90%
And then from the switch,
he connects his PC

41
01:24.150 --> 01:25.625 align:middle line:90%
and all of his
other toys that he's

42
01:25.625 --> 01:27.750 align:middle line:90%
brought in that he wants
physical access to network

43
01:27.750 --> 01:28.330 align:middle line:84%
with.

44
01:28.330 --> 01:29.872 align:middle line:90%
So we could have
multiple devices all

45
01:29.872 --> 01:31.350 align:middle line:84%
coming in on this one port.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:29.872 --> 01:31.350 align:middle line:84%
coming in on this one port.

46
01:31.350 --> 01:34.110 align:middle line:90%
And that port is gig
0/0 on the switch.

47
01:34.110 --> 01:36.390 align:middle line:90%
And the third
challenge is that there

48
01:36.390 --> 01:39.930 align:middle line:90%
could be a hacker or
somebody malicious who

49
01:39.930 --> 01:42.180 align:middle line:90%
is connecting to a
switch port and trying

50
01:42.180 --> 01:43.583 align:middle line:84%
to compromise a switch.

51
01:43.583 --> 01:45.000 align:middle line:90%
And one technique
that can be used

52
01:45.000 --> 01:48.450 align:middle line:90%
is called a CAM table overflow
attack, also sometimes referred

53
01:48.450 --> 01:49.680 align:middle line:84%
to as MAC flooding.

54
01:49.680 --> 01:50.890 align:middle line:84%
And here's how it works.

55
01:50.890 --> 01:53.160 align:middle line:90%
Using malicious software
or software intended

56
01:53.160 --> 01:56.700 align:middle line:90%
to harm the switch, the
device connected to the switch

57
01:56.700 --> 01:59.550 align:middle line:90%
sends in thousands and
thousands of frames.

58
01:59.550 --> 02:02.370 align:middle line:90%
But instead of using its real
Mac address as the source
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
01:59.550 --> 02:02.370 align:middle line:90%
But instead of using its real
Mac address as the source

59
02:02.370 --> 02:06.000 align:middle line:90%
address, it will create a bogus
Mac address or a made-up Mac

60
02:06.000 --> 02:08.620 align:middle line:90%
address for every single
one of the frames.

61
02:08.620 --> 02:12.630 align:middle line:90%
So now, the switch is learning
thousands of source Mac

62
02:12.630 --> 02:14.220 align:middle line:84%
addresses all off gig 0/0.

63
02:14.220 --> 02:16.260 align:middle line:90%
Now what's the
real harm in that?

64
02:16.260 --> 02:18.210 align:middle line:90%
The real harm is that
the switch does not

65
02:18.210 --> 02:21.960 align:middle line:90%
have unlimited memory to
remember all that information.

66
02:21.960 --> 02:24.600 align:middle line:90%
It uses the CAM table-- the
Content Addressable Memory

67
02:24.600 --> 02:26.770 align:middle line:84%
space to remember Mac addresses.

68
02:26.770 --> 02:28.620 align:middle line:90%
And if that is totally
consumed, the switch

69
02:28.620 --> 02:31.500 align:middle line:90%
is not going to have the
ability to correctly understand
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:28.620 --> 02:31.500 align:middle line:90%
is not going to have the
ability to correctly understand

70
02:31.500 --> 02:33.750 align:middle line:90%
which Mac addresses
belong to which ports.

71
02:33.750 --> 02:36.780 align:middle line:90%
And so the hacker, if they do
this CAM table overflow attack

72
02:36.780 --> 02:38.400 align:middle line:90%
and then eavesdrop
on the network,

73
02:38.400 --> 02:40.800 align:middle line:90%
their intent is that they
want to see every frame

74
02:40.800 --> 02:43.620 align:middle line:90%
from every device on
that VLAN being sent out

75
02:43.620 --> 02:45.540 align:middle line:90%
their specific port
where they can now listen

76
02:45.540 --> 02:47.550 align:middle line:84%
to all the traffic on the VLAN.

77
02:47.550 --> 02:49.830 align:middle line:90%
It's also possible that the
performance on the switch

78
02:49.830 --> 02:51.360 align:middle line:90%
is going to be
compromised, which

79
02:51.360 --> 02:53.160 align:middle line:90%
could also act as
a denial of service

80
02:53.160 --> 02:54.870 align:middle line:84%
attack against the switch.

81
02:54.870 --> 02:56.370 align:middle line:90%
And just for fun,
let me demonstrate

82
02:56.370 --> 02:58.710 align:middle line:90%
how easy it is to do
that type of an attack--

83
02:58.710 --> 03:02.192 align:middle line:90%
a CAM table overflow
attack against the switch.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
02:58.710 --> 03:02.192 align:middle line:90%
a CAM table overflow
attack against the switch.

84
03:02.192 --> 03:03.650 align:middle line:90%
So here at the
access layer switch,

85
03:03.650 --> 03:06.900 align:middle line:90%
let's do a few commands just
to verify that gig 0/0 really

86
03:06.900 --> 03:08.710 align:middle line:84%
is associated with VLAN 10.

87
03:08.710 --> 03:10.860 align:middle line:84%
So we'll do a show vlan brief.

88
03:10.860 --> 03:12.060 align:middle line:84%
That'll do it for us.

89
03:12.060 --> 03:13.740 align:middle line:84%
And there's VLAN 10.

90
03:13.740 --> 03:16.050 align:middle line:90%
And VLAN 10 currently has
gig 0/0 assigned to it.

91
03:16.050 --> 03:16.855 align:middle line:84%
Fantastic.

92
03:16.855 --> 03:19.230 align:middle line:90%
Also, if we want to take a
look at the Mac address table,

93
03:19.230 --> 03:21.630 align:middle line:84%
we do a show mac address table.

94
03:21.630 --> 03:25.720 align:middle line:90%
And then we can filter down even
further by specifying VLAN 10.

95
03:25.720 --> 03:27.120 align:middle line:84%
Press Enter.

96
03:27.120 --> 03:28.495 align:middle line:90%
And there's all
the Mac addresses

97
03:28.495 --> 03:30.870 align:middle line:90%
it's learned-- the switch has
learned that are associated
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

97
03:28.495 --> 03:30.870 align:middle line:90%
it's learned-- the switch has
learned that are associated

98
03:30.870 --> 03:31.420 align:middle line:84%
with VLAN 10.

99
03:31.420 --> 03:33.690 align:middle line:90%
And we can even do
one step further.

100
03:33.690 --> 03:35.490 align:middle line:90%
We can go ahead
and do a show mac

101
03:35.490 --> 03:41.700 align:middle line:90%
address-tablespace and
interface gig 0/0 space vlan 10.

102
03:41.700 --> 03:44.200 align:middle line:90%
And that will narrow it down
to the VLAN 10 Mac addresses

103
03:44.200 --> 03:45.570 align:middle line:90%
that it's learned
that are associated

104
03:45.570 --> 03:46.778 align:middle line:84%
with that specific interface.

105
03:46.778 --> 03:49.060 align:middle line:90%
So at the moment,
there's just two of them.

106
03:49.060 --> 03:53.150 align:middle line:90%
Now I have another host that
is connected off of gig 0/0.

107
03:53.150 --> 03:56.290 align:middle line:90%
And it happens to
be a Kali Linux box.

108
03:56.290 --> 04:00.060 align:middle line:90%
So if I log on as the user
root with the password toor--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
03:56.290 --> 04:00.060 align:middle line:90%
So if I log on as the user
root with the password toor--

109
04:00.060 --> 04:02.310 align:middle line:90%
T-O-O-R, which is
root backwards,

110
04:02.310 --> 04:04.600 align:middle line:90%
and then in Kali Linux,
we'll pull up a terminal.

111
04:04.600 --> 04:06.840 align:middle line:90%
And from here, if we
do an ifconfig just

112
04:06.840 --> 04:11.100 align:middle line:90%
to verify our information, so
our IP address is 10.16.0.99.

113
04:11.100 --> 04:16.003 align:middle line:90%
And our Mac address is ending
in fe, four 7's, a 0, and a 1.

114
04:16.003 --> 04:18.420 align:middle line:90%
So that also should show up
as a dynamically-learned layer

115
04:18.420 --> 04:20.190 align:middle line:84%
2 address on VLAN 10.

116
04:20.190 --> 04:21.320 align:middle line:84%
Let's go take a look.

117
04:21.320 --> 04:25.393 align:middle line:90%
So back at the CLI, we'll do
an up arrow key, press Enter.

118
04:25.393 --> 04:27.240 align:middle line:84%
Eh, it's not there.

119
04:27.240 --> 04:28.710 align:middle line:90%
Well, let's go
tell the Kali Linux

120
04:28.710 --> 04:30.080 align:middle line:84%
box to generate some traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:28.710 --> 04:30.080 align:middle line:84%
box to generate some traffic.

121
04:30.080 --> 04:32.330 align:middle line:90%
So back at Kali, let's
generate some traffic.

122
04:32.330 --> 04:36.900 align:middle line:90%
We'll do a ping to 10.16.0.1,
just the VLAN 10 interface

123
04:36.900 --> 04:37.698 align:middle line:84%
on core 1.

124
04:37.698 --> 04:38.990 align:middle line:84%
We should get a response there.

125
04:38.990 --> 04:39.490 align:middle line:84%
Great.

126
04:39.490 --> 04:41.790 align:middle line:90%
Now do a Control-C
to stop that ping.

127
04:41.790 --> 04:43.010 align:middle line:84%
Let's go back to the CLI.

128
04:43.010 --> 04:45.642 align:middle line:90%
I just want to verify that
we are on the right port.

129
04:45.642 --> 04:48.100 align:middle line:90%
And we'll do a show mac address
table for interface gig 0/0

130
04:48.100 --> 04:48.840 align:middle line:84%
at vlan 10.

131
04:48.840 --> 04:49.620 align:middle line:84%
Press Enter.

132
04:49.620 --> 04:50.350 align:middle line:84%
And sure enough.

133
04:50.350 --> 04:51.130 align:middle line:84%
There it is.

134
04:51.130 --> 04:53.100 align:middle line:90%
So the Kali Linux box
was being very quiet

135
04:53.100 --> 04:55.270 align:middle line:90%
in the background until
it generated some traffic.

136
04:55.270 --> 04:57.687 align:middle line:90%
So at this command right here,
we have three Mac addresses

137
04:57.687 --> 05:00.230 align:middle line:90%
that this switch has learned
off gig 0/0 that are all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
04:57.687 --> 05:00.230 align:middle line:90%
that this switch has learned
off gig 0/0 that are all

138
05:00.230 --> 05:01.490 align:middle line:84%
associated with VLAN 10.

139
05:01.490 --> 05:04.790 align:middle line:90%
However, if we use a
little utility like macof,

140
05:04.790 --> 05:08.380 align:middle line:90%
which is built in this part
of the toolset on Kali Linux,

141
05:08.380 --> 05:10.730 align:middle line:84%
we can use M-A-C-O-F space.

142
05:10.730 --> 05:13.400 align:middle line:90%
And then we can go ahead and
do a dash i, specifying, hey,

143
05:13.400 --> 05:15.290 align:middle line:90%
on which interface
do we want to use?

144
05:15.290 --> 05:18.080 align:middle line:90%
And we want to use
Ethernet 0 space.

145
05:18.080 --> 05:20.585 align:middle line:90%
And then just to be kind,
I'm not going to let this run

146
05:20.585 --> 05:22.190 align:middle line:90%
and go [RASPBERRY SOUND],,
millions

147
05:22.190 --> 05:23.440 align:middle line:84%
and millions of packets.

148
05:23.440 --> 05:25.720 align:middle line:90%
I'm going to go
ahead and do a dash n

149
05:25.720 --> 05:27.470 align:middle line:84%
and just going to do like 50.

150
05:27.470 --> 05:30.830 align:middle line:90%
Now this is going to spit
out 50 frames, all of which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:27.470 --> 05:30.830 align:middle line:90%
Now this is going to spit
out 50 frames, all of which

151
05:30.830 --> 05:32.630 align:middle line:90%
are going to have
a made up source

152
05:32.630 --> 05:34.790 align:middle line:90%
Mac address as we start
to fill up the CAM table.

153
05:34.790 --> 05:36.260 align:middle line:84%
And it happens really fast.

154
05:36.260 --> 05:37.760 align:middle line:90%
And in this virtualized
environment,

155
05:37.760 --> 05:39.890 align:middle line:90%
this Kali Linux box
is pumping them out

156
05:39.890 --> 05:42.560 align:middle line:90%
faster than the actual switch
can actually learn them

157
05:42.560 --> 05:44.978 align:middle line:84%
because it's also virtualized.

158
05:44.978 --> 05:46.145 align:middle line:84%
So I'll do that a few times.

159
05:46.145 --> 05:50.000 align:middle line:84%


160
05:50.000 --> 05:53.280 align:middle line:90%
And then let's go take
a look at the CAM table.

161
05:53.280 --> 05:55.100 align:middle line:90%
So a moment ago, we
had three Mac addresses

162
05:55.100 --> 05:58.340 align:middle line:90%
that were associated with
VLAN 10 on port gig 0/0.

163
05:58.340 --> 06:01.040 align:middle line:90%
If we hit the up arrow key now
and do that same exact command
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
05:58.340 --> 06:01.040 align:middle line:90%
If we hit the up arrow key now
and do that same exact command

164
06:01.040 --> 06:03.140 align:middle line:84%
again, here we go.

165
06:03.140 --> 06:05.000 align:middle line:84%
There's page one.

166
06:05.000 --> 06:06.560 align:middle line:84%
There's page two.

167
06:06.560 --> 06:08.180 align:middle line:84%
There's page three, et cetera.

168
06:08.180 --> 06:11.210 align:middle line:90%
And if we want to do a
show mac address table,

169
06:11.210 --> 06:16.475 align:middle line:90%
and we'll do a count for
VLAN 10, press Enter.

170
06:16.475 --> 06:17.850 align:middle line:90%
That's going to
get us a summary.

171
06:17.850 --> 06:19.680 align:middle line:84%
So we have 113 Mac addresses.

172
06:19.680 --> 06:22.190 align:middle line:90%
And that's because I only
did that command a few times.

173
06:22.190 --> 06:23.930 align:middle line:90%
But a real attacker
would just let

174
06:23.930 --> 06:27.560 align:middle line:90%
it run and try to compromise
the switch by doing a CAM table

175
06:27.560 --> 06:28.645 align:middle line:84%
overflow attack.

176
06:28.645 --> 06:30.770 align:middle line:90%
So now the question is,
how do we protect ourselves
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

176
06:28.645 --> 06:30.770 align:middle line:90%
So now the question is,
how do we protect ourselves

177
06:30.770 --> 06:32.100 align:middle line:84%
against those three things--

178
06:32.100 --> 06:34.910 align:middle line:90%
number one, not knowing exactly
which device is connecting;

179
06:34.910 --> 06:36.470 align:middle line:90%
number two, having
multiple devices

180
06:36.470 --> 06:38.282 align:middle line:90%
connecting on a single
port; and three,

181
06:38.282 --> 06:40.490 align:middle line:90%
having somebody that tries
to do a CAM table overflow

182
06:40.490 --> 06:42.330 align:middle line:84%
attack against us on the switch?

183
06:42.330 --> 06:45.093 align:middle line:90%
And the answer is a feature
called port security.

184
06:45.093 --> 06:46.760 align:middle line:90%
And in the next video,
we'll take a look

185
06:46.760 --> 06:49.790 align:middle line:90%
at how this feature called
port security protects us

186
06:49.790 --> 06:50.870 align:middle line:84%
against those scenarios.

187
06:50.870 --> 06:52.560 align:middle line:90%
So I'll see you there
in just a moment.

188
06:52.560 --> 06:54.980 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

189
06:54.980 --> 06:58.150 align:middle line:90%
And I'd like to thank
you for viewing.