Cisco & Port-Security (not trying to hack it)

[lupin]

The way this forum is moderated is one of the think I like the most about it as it makes it a lot easier to find the right offensive security related information without having to trawl through useless posts.

Thanks, its good to know that people appreciate this.

[Jac01]

No worries, I have seen the number of "help me crack my neighbour wifi" posts you have to deal with every days so I don't blame you for being abrupt!

The way this forum is moderated is one of the think I like the most about it as it makes it a lot easier to find the right offensive security related information without having to trawl through useless posts.

Thanks, its good to know that people appreciate this.

I second this... thank you to all the mods for this... I think I would probably have a migraine from trawling through all the useless posts by now... just think of yourselves as a human adblock filter.

[PeppersGhost]

Anyone know of a way to implement port-security for specific vendors on Cisco switches (2900s, 3750s, 4500s, etc)? Even though we tell our users over and over and over not to bring their wifi routers to work and plug them in, it still happens too frequently.

Not a specific answer to your question, but this is exactly the reason you should turn off unused (Cisco) switch ports. Wifi routers in the least, not to mention the infamous PDA sniffer/server stashed under a desk. Leave an open switch port and someone will plug something into it.

[Gitsnik]

Not a specific answer to your question, but this is exactly the reason you should turn off unused (Cisco) switch ports. Wifi routers in the least, not to mention the infamous PDA sniffer/server stashed under a desk. Leave an open switch port and someone will plug something into it.

I've always been partial to carrying a $20 powered switch and an assortment of colour cables so I can do an ethernet run and the client doesn't need to notice.

5 minutes in a building and I can sit in the carpark later and do my thing. Couple it with automation tools for netdiscover and the like, and it's like a portable attack platform gone wild

[PeppersGhost]

Yes, I should have said "shutdown" the interfaces:
Something along these lines,

S1(config)#interface range fa0/1-24 <-your unused range goes here
S1(config-if-range)#shutdown

[Gitsnik]

Yes, I should have said "shutdown" the interfaces:

Which doesn't affect what I was saying. If there is no port security turned on, having the unused interfaces off is a mere slight annoyance as the hub/switch + laptop combo will "intercept" a live cable - letting the active machine operate whilst adding my own attack box to the mix.

[PeppersGhost]

Which doesn't affect what I was saying. If there is no port security turned on, having the unused interfaces off is a mere slight annoyance as the hub/switch + laptop combo will "intercept" a live cable - letting the active machine operate whilst adding my own attack box to the mix.

Oh, lol I see where your heading with this Gitsnik! No stopping the determined.
OP, you see even your best efforts can be a slight annoyance to someone like Gitsnik. Even if the switch was locked in the closet Gitsnik will pop a hub inline with a live wire. I don't know who your customers are Gitsnik, but where I normally work everyone is escorted in person. One of those wrt54g's and a tap would work nice. Or even a PDA with a tap. Or a switchblade. Your right man it is true, I don't think anyone will ever be 100% secure. All we can do is our very best effort. And escort everyone in person! I'm really going to miss this place.

[Snayler]

(...) not to mention the infamous PDA sniffer/server stashed under a desk. Leave an open switch port and someone will plug something into it.

Weaponizing Apple's iPod Touch

Damn iPod's... Someday they will rule the world.

[Gitsnik]

but where I normally work everyone is escorted in person.

I've never been to a place that prevented a sparky from working on his own, or an A/C guy.

The few times I've actually been escorted on jobs, simply asking for a glass of water or something is enough for the person to go and get it for you (generally). Often times you can just pop behind a desk while the person sits bored above it and do the work.

Anyway that was an interesting and fun trip down memory lane, now to grab my iPod touch and have a go at setting that one up