HP 635n Practical IPsec Deployment for Printing and Imaging Devices - Page 17

Ethernet conversation between "F" and "D" A - Port 1 The Switch is configured to Mirror Port 1 to Port 5. In other words, all packets sent/received on Port 1 are sent/received on Port 5. Port 5 is a special port called a Mirror port. Device E cannot participate in networking conversations, it can only listen to them. B - Port 2 Ethernet conversation between "F" and "D" C - Port 3 D - Port 4 ` F - Port 6 E - Port 5 E is a laptop with Wireshark installed Figure 15 - Mirror Port While the mirror port capability was put into switches to help network administrators, it can also help our attacker Jane. Using a variety of different techniques (which would lead us too far astray to go into but are very easy to execute), she discovers the Ethernet switch vendor and switch model number. Jane finds the manual for the switch on the Internet and discovers that this particular model has mirror port capability and remote management capability. In other words, this switch can have an IP address for remote management. An Ethernet Switch can have an IP address? Of course, many network management tools communicate with Ethernet switches over TCP/IP to get a variety of network monitoring information. In this particular case, Jane figures out the IP address of the switch (again, very easy but would lead us too far astray to go into). Jane uses the application called Telnet and tries to telnet into the switch. It works! The network administrator didn't realize that this switch had network management capability and never setup a password for it. The switch was able to obtain an IP address automatically using DHCP and the network administrator never knew! Using the user manual that Jane found on the web, she goes to the open conference area with her laptop. She resets all the packet counters on the switch. She then floods the switch with a short burst of packets and checks the receive counters. Using these counter values, she determines which port on the switch is associated with the open conference area - Let's say port 5. She uses the same technique, whenever someone uses the secured MFP, to determine the MFP's port number - Let's say port 1. She then uses Telnet to configure port 5 to be a Mirror port, duplicating the packets to and from port 1. Now she is able to use Wireshark to capture networking conversations to and from the MFP. When she is done capturing packets, she moves to another open conference room and deletes the mirror port configuration. Too Easy: MITM Active Sniffing Well, you may have read the last section and said: "This isn't a problem for me because (1) all my Ethernet switches are under lock and key, (2) These switches do not flood open, and (3) their network management interfaces are secured. Therefore, there is no longer any way for Jane to capture my MFP's data". Not True! In this section, we are going to cover another way Jane could have captured the data. We will continue to use Wireshark and Ettercap. 17