Tool for Identifying Rogue Linksys Routers

[Martin Mkrtchian]

Dear Group Members

We are migrating from Lucent QIP to MetaIP for DHCP services and so
far we have had two issues when MetaIP has been implemented for  VLAN
that has an unauthorized Linksys router giving out IP addresses.

Is there a scanning tool out there that can determine if there are
unauthorized Linksys (type) routers in a specific VLAN?

Your input is appreciated

Thank You

Martin  M
http://dotsecure.blogspot.com

[Joshua Wright]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Martin,

Martin Mkrtchian wrote:
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?

You can use the Nessus plugin 11026 (find_ap.nasl) to scan your network
for open HTTP, SNMP and FTP servers.  Using Nmap fingerprinting and
banner grabbing, this plugin does a decent job at finding rogue AP's
that don't mind being found (e.g. they haven't been specifically
configured to hide from administrators).

Alternatively, wireless-side analysis is the way to go to locate rogue
AP's!  Kismet (www.kismetwireless.net), or a commercial tool will be
helpful there.

- -Josh
- --
- -Joshua Wright
jwright@...

2005-2006 pgpkey: http://802.11ninja.net/pgpkey.htm
fingerprint: F00E 7A42 8375 0C55 964F E5A4 4D2F 22F6 3658 A4BF

Today I stumbled across the world's largest hotspot.  The SSID is "linksys".
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDDjTNTS8i9jZYpL8RAqbCAKCD7fGJk/tCRrPg8BfQ2p+tbC0zRgCg4ZLX
u8D2UrPqEa2Q17fDiu8x0oM=
=0/CO
-----END PGP SIGNATURE-----

[Thomas Guyot-Sionnest]

The right way to fix that is to implement switch-level recurity. Limit the
number of mac and IP address on each ports. No workstation should ever have
more that one MAC and IP address...

If you don't have the budget for that kind of switch, I'd first try to
identify open ports and try to recognize services on a linksys router. Nmap
and telnet will be your best friends.

Thomas Guyot-Sionnest,
Administrateur de systèmes
Tél: [phone]
Fax: [phone]
Courriel: thomas@...

> -----Original Message-----
> From: Martin Mkrtchian [mailto:dotsecure@...]
> Sent: Thursday, August 25, 2005 14:49
> To: Bugtraq; Full-Disclosure (E-mail)
> Subject: Tool for Identifying Rogue Linksys Routers
>
> Dear Group Members
>
> We are migrating from Lucent QIP to MetaIP for DHCP services
> and so far we have had two issues when MetaIP has been
> implemented for  VLAN that has an unauthorized Linksys router
> giving out IP addresses.
>
> Is there a scanning tool out there that can determine if
> there are unauthorized Linksys (type) routers in a specific VLAN?
>
> Your input is appreciated
>
> Thank You
>
> Martin  M
> http://dotsecure.blogspot.com
>

[Mike Frantzen]

> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?
 
All linksys MACs will have an address with one of these prefixes:
        00045A       The Linksys Group,
        000625       The Linksys Group, In
        000C41       The Linksys Group, In
        000F66       Cisco-Linksys
        001217       Cisco-Linksys, LLC
        001310       Cisco-Linksys, LLC
e.g.
        00:04:5A:xx:xx:xx


Plug a laptop into any worrisome network segments and look for a linksys
MAC address. If the linksys routers talk IPv6:
        ping6 -w ff02:1%fxp0    (or %eth0 or whatever your interface is)
Otherwise do a broadcast ping, a ping sweep, or whatever will tickle a
linksys router.

(friendly reminder: the host's MAC address will not be preserved if the
packet goes through a router)

.mike
frantzen@(nfr.com | cvs.openbsd.org | w4g.org)
PGP:  CC A4 E2 E8 0C F8 42 F0  BC 26 85 5B 6F 9E ED 28

[Dave Hull]

If the Linksys devices are DHCP clients themselves, you might be able
to use DHCPFingerprint to locate them when they renew their leases.

You may want to contact the folks at http://www.packetfence.org. They
may have a more comprehensive list of signatures.

Also, nmap may work, see
http://seclists.org/lists/nmap-dev/2003/Apr-Jun/0010.html for more
details.

Examining TTLs of packets coming from edge devices may also give you
some indication of who's sitting behind an extra hop, though some
folks may be savvy enough to tweak this on their workstations to avoid
detection.

Good luck.

On 8/25/05, Martin Mkrtchian <dotsecure@...> wrote:

> Dear Group Members
>
> We are migrating from Lucent QIP to MetaIP for DHCP services and so
> far we have had two issues when MetaIP has been implemented for  VLAN
> that has an unauthorized Linksys router giving out IP addresses.
>
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?
>
> Your input is appreciated
>
> Thank You
>
> Martin  M
> http://dotsecure.blogspot.com
>

--
Dave Hull
ireadit@...

[Tony Rall]

On Thursday, 2005-08-25 at 11:48 MST, Martin Mkrtchian
<dotsecure@...> wrote:
> We are migrating from Lucent QIP to MetaIP for DHCP services and so
> far we have had two issues when MetaIP has been implemented for  VLAN
> that has an unauthorized Linksys router giving out IP addresses.
>
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?

First you say you have a problem with rogue dhcp servers (don't we all?),
then you way you're looking for routers.

For the rogue dhcp server problem, there are 2 types of this problem, but
unfortunately the solutions I've found aren't quite as specific to dhcp as
I would like.

Blocking at layer 3 (router) is relatively easy - you can block traffic to
68/udp except from your official dhcp servers.

Blocking at layer 2 is harder.  Here is a suggestion for doing it on Cisco
switches (which might not work on low end equipment - haven't tried that -
the switches must support vlan filtering):

Using vlan filtering, define that rogue traffic is dropped and logged; all
other traffic is forwarded:

vlan access-map dhcpmap 10
 match ip address rogue_dhcp
 action drop log
vlan access-map dhcpmap 20
 match ip address any_host
 action forward
exit

An access list that matches all traffic:

ip access-list standard any_host
 remark Provide a match (permit) for all traffic
 permit any
exit

An access list that matches rogue dhcp traffic.  (With Cisco's strange
vlan access mechanism, it requires that we appear to be blocking the valid
traffic and allowing the bad stuff.  But, in conjunction with the
access-map, just the opposite occurs.)

ip access-list extended rogue_dhcp
 remark Provide a match (permit) for dhcp responses from rogue servers
 deny   udp host 10.1.32.21 any eq bootpc    ! these are my official dhcp
servers
 deny   udp host 10.1.32.22 any eq bootpc    ! likewise
 deny   udp 10.1.0.0 0.0.252.7 any eq bootpc   ! my routers, that might be
relaying legitimate dhcp
 permit udp any any eq bootpc                ! the match that will catch
the rogues
 deny   ip any any                               ! don't catch anything
else
exit

Apply this setup to the vlans supported by my dhcp servers:

vlan filter dhcpmap vlan-list 64-128,136-140,146,232


The way this works it could result in blocking some traffic that you
really don't  want to (for example, if any of your users employ PIXIE to
load some of their machines).  If so, you will need to add the addresses
of those server machines to the filter as though they were official dhcp
servers - so that their bootpc traffic is not blocked.

Tony Rall