What Is VLAN Hopping Attack? How Does VLAN Hopping Work

VLAN Hopping Attack

By sending or receiving traffic from one Virtual Local Area Network (VLAN) into another, an attacker might get unauthorized access to resources and traffic that should typically be segregated. This technique is known as VLAN Hopping.

In order to improve security and performance, VLANs are used to divide and isolate network traffic. Bypassing this segmentation, a successful VLAN hopping attack jeopardizes the confidentiality and integrity of the network. This falls under the category of Layer 2 (L2) attacks, which take advantage of protocol behavior or configuration errors pertaining to 802.1Q tagging, trunking, native VLANs, and switch port modes.

A VLAN hopping attack can be carried out in two main ways: Switch Spoofing (DTP Exploitation) and Double Tagging (Native VLAN Exploitation).

You can also read HTTPS Spoofing Explained: Techniques, Risks And Prevention

How does vlan hopping work?

Double Tagging (802.1Q Tag Stacking)

This attack takes advantage of the way some switches handle a trunk link’s native VLAN. Usually, native VLAN traffic is transmitted across the trunk untagged.

How the Attack Works:

• A deliberately crafted Ethernet frame with two 802.1Q tags is created by the attacker, who is typically connected to an access port in the same VLAN configuration as the native untagged VLAN on the trunk.
• Outer Tag: The attacker’s current VLAN, which is configured to match the trunk’s native VLAN ID (e.g., VLAN 1), is represented by the outer tag.
• Inner Tag: This tag contains the ID of the target VLAN (such as VLAN 20) that the attacker wishes to access.
• Upon receiving the double-tagged frame, the first switch examines the outer tag, identifies it as native VLAN traffic, and removes only the outer tag.
• The frame is forwarded up the trunk link by the switch. Importantly, the inner tag of the victim’s VLAN ID is still there in the packet.
• Bypassing the isolation, the subsequent switch along the trunk incorrectly sends the frame to the target host in the victim’s VLAN after reading the last (inner) tag.

Limitation: The attacker cannot rely on receiving return traffic from the victim’s VLAN because double tagging is typically regarded as a one-way trip (unidirectional flow).

Switch Spoofing (DTP Exploitation)

The Dynamic Trunking Protocol (DTP), which is intended to negotiate the establishment of trunk links between switches, is the foundation of this assault.

How the Attack Works:

• Vulnerability: A lot of switch ports are left in their default switchport modes, which are frequently set up to automatically negotiate a trunk, like “dynamic auto” or “dynamic desirable.” Many people consider this to be a misconfiguration.
• By setting up their computer to mimic a switch, the attacker can send DTP negotiation messages to the port of the real switch.
• The attacker’s access port is tricked into becoming a trunk port on the legitimate switch.
• After successfully establishing a trunk link, the attacker’s device can send and receive traffic from all VLANs that are reachable through that trunk.

Risk: Because switch spoofing enables the attacker to establish two-way communication with the compromised VLANs, it is frequently seen as more hazardous than double-tagging.

Impact of VLAN Hopping

A successful VLAN hopping attack compromises network segmentation, posing serious risks:

• It makes it possible for attackers to access resources and systems on previously separated segments like servers, management networks, or VLANs for sensitive data without authorization.
• It makes it easier to pivot and move laterally within the network.
• Attackers are able to get around firewalling measures and Access Control Lists (ACLs) that are meant to be enforced at VLAN boundaries.
• VLAN hopping can be used to spread other threat vectors, overload networks, implant malware, and steal confidential data.

VLAN Hopping prevention

Network switches must be configured carefully and securely to prevent VLAN hopping.

Mitigation against Switch Spoofing (DTP Exploitation):

• Explicitly Configure Access Ports: Configure all user-facing ports as explicit access ports (switchport mode access).
• Disable DTP: Turn off trunking negotiation (DTP/auto-trunking) on access ports (e.g., using switchport nonegotiate on Cisco devices). Never leave ports in dynamic auto or desirable modes.

Mitigation against Double Tagging (Native VLAN Exploitation):

• Change Native VLAN:  Replace the default VLAN ID (VLAN 1) on all trunk ports with a unique, unused, and isolated VLAN ID (such as VLAN 999).
• Separate Native and Access VLANs: Never allocate an end-user access port to a VLAN that is also the trunk’s native VLAN.
• Explicit Tagging: All trunk ports should have explicit tagging of the native VLAN configured; however, this needs to be the same for all switches.

General Security Best Practices:

• VLAN Pruning: On trunk ports, allow only the specific, required VLANs (switchport trunk allowed vlan ...).
• Port Security: By limiting the number of MAC addresses that can be learnt per port, port security can assist in stopping rogue switches or hubs from being connected.
• Disable Unused Ports: To disable or shut down any unneeded ports, physically secure the switch and put them in a separate VLAN.
• Authentication: Use 802.1X authentication to have devices authenticate themselves before allowing them to access the network.
• Monitoring: Keep an eye out for unusual network activity, such as a high frequency of 802.1Q-tagged frames coming from an access port or odd MAC addresses being learnt on a single port for numerous VLANs.

You can also read Rogue DHCP Server Detection And Mitigation Techniques