Scriblings Of A GEEK

HSRP Exploit : Continuing on with my previous posts on HSRP

Hey ALL on a Sunday evening,

Many of us have implemented HSRP in our network if we have a an all Cisco devices which is enerally the case in India. Just though about mentioning a HSRP hack , a very old one though. Before i go on in case u wanna know more on HSRP and how to configure it you can go to my previous posts Linux and HSRP or call it LINUX HSRP and it links to all the previous posts too:).

Continuing with todays topic on the exploit in HSRP :

HSRP uses UDP port 1985 to communicate with other routers about its support for HSRP (It sends packets on the multicast address of 224.0.0.2). Since by default (Cisco doesn't recommend this but most systems are installed in this manner) HSRP's authentication process is done in clear text it is possible to spoof a valid HSRP session. One of the options that can be accomplished by spoofing the protocol is a DoS attack.

What Cisco's is gotta say on this is below :

Cisco recommends that IPSec is deployed to prevent such protocol spoofing and you can access a how-to by them here.

I haven't tried it in with VRRP but i guess VRRP shld also be venurable to this exploit. It is just spoofing of mac ID in layman terms and you need not worry until you have a micreant on the network who wants to take you for a ride.

I am off to coffee now with my pals at quicky's the indian version of starbucks.

Till the next time happy working:)


Nitin

posted by Nitin @ 1/16/2005 09:32:00 PM