VLANtägäys

VLANtägäys, also known as VLAN hopping, is a network security vulnerability that allows an attacker to gain unauthorized access to traffic on different virtual local area networks (VLANs) than the one they are currently connected to. This is typically achieved by exploiting the way switches handle VLAN tagging.

There are two primary methods of VLAN hopping: Switch spoofing and Double tagging. In switch spoofing, an attacker configures their machine to impersonate a switch. They then send special frames to the legitimate switch, tricking it into thinking the attacker's machine is another switch on the network. This can allow the attacker to send frames to any VLAN. Double tagging involves manipulating the 802.1Q VLAN tags. The attacker crafts a frame with two VLAN tags. The first tag is for the attacker's own VLAN, which the first switch processes and strips off. The second tag, intended for the target VLAN, is then processed by the next switch, allowing the attacker's frame to reach the unintended VLAN.

The consequences of a successful VLAN hop can be severe. Attackers can eavesdrop on sensitive data, inject malicious traffic, or even take control of devices on other VLANs. This bypasses the network segmentation that VLANs are designed to provide, undermining the security architecture.

Mitigation strategies for VLAN hopping include disabling unused ports and assigning them to a non-existent VLAN, implementing port security features on switches, and disabling trunking protocols like DTP (Dynamic Trunking Protocol) on user-facing ports. Carefully configuring VLAN assignments and regularly auditing network devices are also crucial steps to prevent and detect such attacks.