Re: Tool for Identifying Rogue Linksys Routers

[Mike Frantzen]

> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?

All linksys MACs will have an address with one of these prefixes:
00045A The Linksys Group,
000625 The Linksys Group, In
000C41 The Linksys Group, In
000F66 Cisco-Linksys
001217 Cisco-Linksys, LLC
001310 Cisco-Linksys, LLC
e.g.
00:04:5A:xx:xx:xx


Plug a laptop into any worrisome network segments and look for a linksys
MAC address. If the linksys routers talk IPv6:
ping6 -w ff02:1%fxp0 (or %eth0 or whatever your interface is)
Otherwise do a broadcast ping, a ping sweep, or whatever will tickle a
linksys router.

(friendly reminder: the host's MAC address will not be preserved if the
packet goes through a router)

..mike
frantzen@(nfr.com | cvs.openbsd.org | w4g.org)
PGP: CC A4 E2 E8 0C F8 42 F0 BC 26 85 5B 6F 9E ED 28

[Thomas Guyot-Sionnest]

This is a multi-part message in MIME format.

------=_NextPart_000_000D_01C5A99D.BA75F760
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

The right way to fix that is to implement switch-level recurity. Limit =
the
number of mac and IP address on each ports. No workstation should ever =
have
more that one MAC and IP address...

If you don't have the budget for that kind of switch, I'd first try to
identify open ports and try to recognize services on a linksys router. =
Nmap
and telnet will be your best friends.

Thomas Guyot-Sionnest,
Administrateur de syst=E8mes
T=E9l: (514) 842-7054
Fax: (514) 221-3395
Courriel: thomas@zango.com=20

> -----Original Message-----
> From: Martin Mkrtchian [mailto:dotsecure@gmail.com]=20
> Sent: Thursday, August 25, 2005 14:49
> To: Bugtraq; Full-Disclosure (E-mail)
> Subject: Tool for Identifying Rogue Linksys Routers
>=20
> Dear Group Members
>=20
> We are migrating from Lucent QIP to MetaIP for DHCP services=20
> and so far we have had two issues when MetaIP has been=20
> implemented for VLAN that has an unauthorized Linksys router=20
> giving out IP addresses.
>=20
> Is there a scanning tool out there that can determine if=20
> there are unauthorized Linksys (type) routers in a specific VLAN?
>=20
> Your input is appreciated=20
>=20
> Thank You
>=20
> Martin M
> http://dotsecure.blogspot.com
>=20

------=_NextPart_000_000D_01C5A99D.BA75F760
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIIJNjCCAr4w
ggInoAMCAQICAw7RSDANBgkqhkiG9w0BAQQFADBiMQswCQYDVQ QGEwJaQTElMCMGA1UEChMcVGhh
d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVG hhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIElzc3VpbmcgQ0EwHhcNMDUwNTMwMjExNTIzWhcNMDYwNT MwMjExNTIzWjCBizEfMB0GA1UE
AxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEfMB0GCSqGSIb3DQ EJARYQdGhvbWFzQGNkdGluYy5j
YTEmMCQGCSqGSIb3DQEJARYXdGhvbWFzQDE4MHNvbHV0aW9ucy 5jb20xHzAdBgkqhkiG9w0BCQEW
EHRob21hc0B6YW5nby5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY 0AMIGJAoGBAM3uzCa/SUTCf/PH
GQrQjvAMu405PYlXrJNRuXrzvvaRQ7C63JfMKZREq1iJao1yWG s7CdW5tezAm33eVTGVEQSFmaGo
EilKWbIak5nY9Bw227uiPqpWQoyp6+OXgcO9U096sshvJOgoxK Ygbxl3VZLf8vcpwptiCPDn/cDb
tW0jAgMBAAGjWDBWMEYGA1UdEQQ/MD2BEHRob21hc0BjZHRpbmMuY2GBF3Rob21hc0AxODBzb2x1
dGlvbnMuY29tgRB0aG9tYXNAemFuZ28uY29tMAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQAD
gYEAwnv5kravOTK565Y2MNChLdr60CgLhGoUoUfw3kB3YtL4c7 Ar37IXDjl9uESIGEUpNNk9y/YQ
9xHxOA235txi9P3jXk1J2H3Rp8ytTlRGT43tQ/GC3t6moSrCBZ3IFNgVrvtlI2hVKL3I9OK9JeSI
TNwF0eNw1yOB6NOBLcpRwsMwggMtMIIClqADAgECAgEAMA0GCS qGSIb3DQEBBAUAMIHRMQswCQYD
VQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQ QHEwlDYXBlIFRvd24xGjAYBgNV
BAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aW ZpY2F0aW9uIFNlcnZpY2VzIERp
dmlzaW9uMSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwgRnJlZW 1haWwgQ0ExKzApBgkqhkiG9w0B
CQEWHHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0ZS5jb20wHhcNOT YwMTAxMDAwMDAwWhcNMjAxMjMx
MjM1OTU5WjCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3 Rlcm4gQ2FwZTESMBAGA1UEBxMJ
Q2FwZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZz EoMCYGA1UECxMfQ2VydGlmaWNh
dGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3 RlIFBlcnNvbmFsIEZyZWVtYWls
IENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbE B0aGF3dGUuY29tMIGfMA0GCSqG
SIb3DQEBAQUAA4GNADCBiQKBgQDUadfUsJRkW3HpR9gMUbbqcp GwhF59LQ2PexLfhSV1KHQ6Qixj
J5+Ve0vvfhmHHYbqo925zpZkGsIUbkSsfOaP6E0PcR9AOKYAo4 d49vmUhl6t6sBeduvZFKNdbnp8
DKVLVX8GGSl/npom1Wq7OCQIapjHsdqjmJH9edvlWsQcuQIDAQABoxMwETAPBg NVHRMBAf8EBTAD
AQH/MA0GCSqGSIb3DQEBBAUAA4GBAMfskn5O+PWWpWdiKqTwTRFg0G +NYFhhrCa7UjVcCM8w+6hK
loofYkIjjBcP9LpknBesRynfnZhe0mxgcVyirNx54+duAEcftQ 0o6AKd5Jr9E/Sm2Xyx+NxfIyYJ
kYBz0BQb3kOpgyXy5pwvFcr+pquKB3WLDN1RhGvk+NHOd6KBMI IDPzCCAqigAwIBAgIBDTANBgkq
hkiG9w0BAQUFADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDF dlc3Rlcm4gQ2FwZTESMBAGA1UE
BxMJQ2FwZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdG luZzEoMCYGA1UECxMfQ2VydGlm
aWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVG hhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbW FpbEB0aGF3dGUuY29tMB4XDTAz
MDcxNzAwMDAwMFoXDTEzMDcxNjIzNTk1OVowYjELMAkGA1UEBh MCWkExJTAjBgNVBAoTHFRoYXd0
ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYX d0ZSBQZXJzb25hbCBGcmVlbWFp
bCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ KBgQDEpjxVc1X7TrnKmVoeaMB1
BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU5VAKMNcCY1osiRVwjt3J8CuFWqo/cVbLrzwLB+fx
H5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTXp6a7n2XRxSpUhQ9IBH+nttE8YQRAHmQZcmC3 +wID
AQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8CAQAwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2N y
bC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFsRnJlZW1haWxDQS 5jcmwwCwYDVR0PBAQDAgEGMCkG
A1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2YXRlTGFiZWwyLT EzODANBgkqhkiG9w0BAQUFAAOB
gQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aUnX9MIbj4Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZ
foSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5jowgT2Vfldr394 fWxghOrvbqNOUQGls1TXfjViF4
gtwhGTXeJLHTHUb/XV9lTzGCAs8wggLLAgEBMGkwYjELMAkGA1UEBhMCWkExJTAjBg NVBAoTHFRo
YXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1 RoYXd0ZSBQZXJzb25hbCBGcmVl
bWFpbCBJc3N1aW5nIENBAgMO0UgwCQYFKw4DAhoFAKCCAbwwGA YJKoZIhvcNAQkDMQsGCSqGSIb3
DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUwODI1MjE1MjE1WjAjBg kqhkiG9w0BCQQxFgQUUbBHYSwE
cjUcoo5HZJXiWlXpKtQwZwYJKoZIhvcNAQkPMVowWDAKBggqhk iG9w0DBzAOBggqhkiG9w0DAgIC
AIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAw ICASgwBwYFKw4DAhowCgYIKoZI
hvcNAgUweAYJKwYBBAGCNxAEMWswaTBiMQswCQYDVQQGEwJaQT ElMCMGA1UEChMcVGhhd3RlIENv
bnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIF BlcnNvbmFsIEZyZWVtYWlsIElz
c3VpbmcgQ0ECAw7RSDB6BgsqhkiG9w0BCRACCzFroGkwYjELMA kGA1UEBhMCWkExJTAjBgNVBAoT
HFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBA MTI1RoYXd0ZSBQZXJzb25hbCBG
cmVlbWFpbCBJc3N1aW5nIENBAgMO0UgwDQYJKoZIhvcNAQEBBQ AEgYCAjUcO5JIkDKE8udUVZFAq
VQLyb8M2+bsKbT4R9RiA1aLxDGYwfDobVvfNnNz3m5VdVkOnDE 6GKQzJw+y/DZJDZuK+SLySOl+/
w+9MPQyQZVnl9ZmuWJF9RlS5R4eiLObWYn8Z7L7fsa5MCvJKev UzfBCQp8Cdjf+tSQ5FVGWK0wAA
AAAAAA==

------=_NextPart_000_000D_01C5A99D.BA75F760--

[Joshua Wright]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Martin,

Martin Mkrtchian wrote:
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?

You can use the Nessus plugin 11026 (find_ap.nasl) to scan your network
for open HTTP, SNMP and FTP servers. Using Nmap fingerprinting and
banner grabbing, this plugin does a decent job at finding rogue AP's
that don't mind being found (e.g. they haven't been specifically
configured to hide from administrators).

Alternatively, wireless-side analysis is the way to go to locate rogue
AP's! Kismet (www.kismetwireless.net), or a commercial tool will be
helpful there.

- -Josh
- --
- -Joshua Wright
jwright@hasborg.com

2005-2006 pgpkey: http://802.11ninja.net/pgpkey.htm
fingerprint: F00E 7A42 8375 0C55 964F E5A4 4D2F 22F6 3658 A4BF

Today I stumbled across the world's largest hotspot. The SSID is "linksys".
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDDjTNTS8i9jZYpL8RAqbCAKCD7fGJk/tCRrPg8BfQ2p+tbC0zRgCg4ZLX
u8D2UrPqEa2Q17fDiu8x0oM=
=0/CO
-----END PGP SIGNATURE-----

[Graham Wilson]

On Thu, Aug 25, 2005 at 11:48:38AM -0700, Martin Mkrtchian wrote:
> We are migrating from Lucent QIP to MetaIP for DHCP services and so
> far we have had two issues when MetaIP has been implemented for VLAN
> that has an unauthorized Linksys router giving out IP addresses.
>
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?

Try pinging all hosts using nmap:

# nmap -sP 192.168.1.0/24

Then look at the arp cache:

# arp | grep ether

Then find MAC addresses that are from Linksys's space. I know macchanger
[1] has a list of what addresses belong to which vendors.

Hope this helps.

[1] http://www.alobbs.com/modules.php?op=modload&name=macc&file=index

--
gram

[Matt Mercer]

Hi Martin,

>We are migrating from Lucent QIP to MetaIP for DHCP services and so
>far we have had two issues when MetaIP has been implemented for VLAN
>that has an unauthorized Linksys router giving out IP addresses.

If you have an IDS such as Snort configured on your network, it would be
fairly straightforward to build a configuration watching for DHCP
traffic on specific VLANs not originating from legitimate servers (as
defined by you, The Administrator).

Find a helpful article here describing such a scenario:

http://security.itworld.com/4363/ITW3542/page_1.html

HTH,

Matt

[Dave Hull]

If the Linksys devices are DHCP clients themselves, you might be able
to use DHCPFingerprint to locate them when they renew their leases.

You may want to contact the folks at http://www.packetfence.org. They
may have a more comprehensive list of signatures.

Also, nmap may work, see
http://seclists.org/lists/nmap-dev/2003/Apr-Jun/0010.html for more
details.

Examining TTLs of packets coming from edge devices may also give you
some indication of who's sitting behind an extra hop, though some
folks may be savvy enough to tweak this on their workstations to avoid
detection.

Good luck.

On 8/25/05, Martin Mkrtchian <dotsecure@gmail.com> wrote:
> Dear Group Members
>=20
> We are migrating from Lucent QIP to MetaIP for DHCP services and so
> far we have had two issues when MetaIP has been implemented for VLAN
> that has an unauthorized Linksys router giving out IP addresses.
>=20
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?
>=20
> Your input is appreciated
>=20
> Thank You
>=20
> Martin M
> http://dotsecure.blogspot.com
>=20


--=20
Dave Hull
ireadit@gmail.com

[Volker Tanger]

Hi Group!

On Fri, 26 Aug 2005 09:32:31 -0500
Graham Wilson <graham@mknod.org> wrote:
>
> > Is there a scanning tool out there that can determine if there are
> > unauthorized Linksys (type) routers in a specific VLAN?

I assume you have not port-locked your switches? Many managed Layer-2
switches can do that. Only allow 1-2 IP addresses per port and
auto-shutdown those exceeding this limit. This way you have an
automatic, continuously running monitoring (and self-punishment) of
people connecting rogue switches/routers. Plus you know where (on which
plug) to search for the system. Won't detect NAT-masquerading routers
that have their external interface connected to LAN, though.

A purely passive approach would be to use ARPWATCH and filter out all
known MAC address headers. Easy if you have a homogenous network (e.g.
all PCs are Dell), a PITB of you are a wild mishmash (open pool at
university or LAN party). You even can run this from a CRON job. And if
you're really, really thorough you could inventarize all your PCs
(semi-automatically) and have an alert for each new MAC address that pop
up.

For a scan you could run arpwatch and then ping all hosts using nmap
(assuming that your network is 192.168.1.*/24 in this example):

# nmap -sP 192.168.1.0/24

Depending on your network architecture you might want to slow that down
with

# nmap -T polite -sP 192.168.1.0/24

Arpwatch will do the job of collecting all ARP addresses for you.

Bye

Volker

--

Volker Tanger http://www.wyae.de/volker.tanger/
--------------------------------------------------
vtlists@wyae.de PGP Fingerprint
378A 7DA7 4F20 C2F3 5BCC 8340 7424 6122 BB83 B8CB

[Mike Kershaw]

--Q68bSM7Ycu6FN28Q
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

> > Is there a scanning tool out there that can determine if there are
> > unauthorized Linksys (type) routers in a specific VLAN?
>=20
> Try pinging all hosts using nmap:
>
> Then find MAC addresses that are from Linksys's space. I know macchanger
> [1] has a list of what addresses belong to which vendors.

Except, of course, that most Linksys units allow mac cloning through the
web interface.

This won't find anyone who is deliberately avoiding the scan, nor anyone
who messed with the config out of boredom.

-m

--=20
Mike Kershaw/Dragorn <dragorn@kismetwireless.net>
GPG Fingerprint: 3546 89DF 3C9D ED80 3381 A661 D7B2 8822 738B BDB1

Bus Error at 008BE426 while reading byte from DEADBEEF in User data space


--Q68bSM7Ycu6FN28Q
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDD6fM17KIInOLvbERAjbKAKDdpfeCAKC6zYYBnZzjan x02BnhMACeI8SW
IsIdR0yDEDCF9GK7yp0dwNg=
=e8YO
-----END PGP SIGNATURE-----

--Q68bSM7Ycu6FN28Q--

[Paul Halliday]

Why not arpwatch? It is tiny, simple and passive.

On 8/25/05, Matt Mercer <MattM@pyramidcorporation.com> wrote:
> Hi Martin,
>=20
> >We are migrating from Lucent QIP to MetaIP for DHCP services and so
> >far we have had two issues when MetaIP has been implemented for VLAN
> >that has an unauthorized Linksys router giving out IP addresses.
>=20
> If you have an IDS such as Snort configured on your network, it would be
> fairly straightforward to build a configuration watching for DHCP
> traffic on specific VLANs not originating from legitimate servers (as
> defined by you, The Administrator).
>=20
> Find a helpful article here describing such a scenario:
>=20
> http://security.itworld.com/4363/ITW3542/page_1.html
>=20
> HTH,
>=20
> Matt
>=20


--=20
_________________
Paul Halliday
http://dp.penix.org

"Diplomacy is the art of saying "Nice doggie!" till you can find a rock."

[Tony Rall]

On Thursday, 2005-08-25 at 11:48 MST, Martin Mkrtchian
<dotsecure@gmail.com> wrote:
> We are migrating from Lucent QIP to MetaIP for DHCP services and so
> far we have had two issues when MetaIP has been implemented for VLAN
> that has an unauthorized Linksys router giving out IP addresses.
>
> Is there a scanning tool out there that can determine if there are
> unauthorized Linksys (type) routers in a specific VLAN?

First you say you have a problem with rogue dhcp servers (don't we all?),
then you way you're looking for routers.

For the rogue dhcp server problem, there are 2 types of this problem, but
unfortunately the solutions I've found aren't quite as specific to dhcp as
I would like.

Blocking at layer 3 (router) is relatively easy - you can block traffic to
68/udp except from your official dhcp servers.

Blocking at layer 2 is harder. Here is a suggestion for doing it on Cisco
switches (which might not work on low end equipment - haven't tried that -
the switches must support vlan filtering):

Using vlan filtering, define that rogue traffic is dropped and logged; all
other traffic is forwarded:

vlan access-map dhcpmap 10
match ip address rogue_dhcp
action drop log
vlan access-map dhcpmap 20
match ip address any_host
action forward
exit

An access list that matches all traffic:

ip access-list standard any_host
remark Provide a match (permit) for all traffic
permit any
exit

An access list that matches rogue dhcp traffic. (With Cisco's strange
vlan access mechanism, it requires that we appear to be blocking the valid
traffic and allowing the bad stuff. But, in conjunction with the
access-map, just the opposite occurs.)

ip access-list extended rogue_dhcp
remark Provide a match (permit) for dhcp responses from rogue servers
deny udp host 10.1.32.21 any eq bootpc ! these are my official dhcp
servers
deny udp host 10.1.32.22 any eq bootpc ! likewise
deny udp 10.1.0.0 0.0.252.7 any eq bootpc ! my routers, that might be
relaying legitimate dhcp
permit udp any any eq bootpc ! the match that will catch
the rogues
deny ip any any ! don't catch anything
else
exit

Apply this setup to the vlans supported by my dhcp servers:

vlan filter dhcpmap vlan-list 64-128,136-140,146,232


The way this works it could result in blocking some traffic that you
really don't want to (for example, if any of your users employ PIXIE to
load some of their machines). If so, you will need to add the addresses
of those server machines to the filter as though they were official dhcp
servers - so that their bootpc traffic is not blocked.

Tony Rall