DoS on STP.
Oleg Petukhov, lawyer in the field of international law and personal data protection, information security specialist security, protection of information and personal data.
Telegram channel: https://t.me/protectioninformation
Telegram Group: https://t.me/informationprotection1
Website: https://legascom.ru
Email: online@legascom.ru
#informationprotection #informationsecurity
DOS (Denial of Service) attacks are a type of attack in which the attacked node stops functioning normally. As a rule, these attacks do not cause the hardware of the attacked node to fail, however, a reboot is usually required to restore functionality. DoS attacks can be either an independent type of attack, or part of composite attacks aimed at disabling a legitimate service in order to replace it with a fake one controlled by an attacker. Let's look at several DoS attacks on the STP protocol.
DoS: iterating over the Bridge Id.
The attacker intercepts BPDU frames from the current root switch and sends his BPDU one less. Then the BPDU is sent with the switch ID one less than the previous one. When the minimum value is reached, the attacker waits until it becomes obsolete due to a pause, and then starts all over again.
As a result, the network is constantly in the process of selection and the ports will not switch to packet forwarding while the generation of BPDUs causing the selection continues.
An alternative option is to immediately send a BPDU with a minimum ID. Then the root switch just disappears.
DoS: merge–divergence of STP trees.
This attack is possible on a VLAN-enabled network (we'll talk about this technology a bit later). If an attacker connects two VLANs and starts forwarding BPDUs from one network to another, the STP trees will see each other, and the root bridge selection is initialized. After the end of the elections, the connection is broken, and the elections begin again.
DoS: BPDU filtering.
The essence of this attack is that the attacker creates a loop between two STP devices and filters all BPDU packets on this segment without affecting the rest of the traffic. Thus, the main purpose of the STP protocol will not be fulfilled.
In practice, such attacks can be implemented using the Yersinia utility from Kali Linux.
