1

I am aware the meeting rooms which are outside the office premises have MAC based restrictions on their LAN port.

The meeting room does have a wired lan segment. what could possibly go wrong since the visitor (non employee) to meeting room (assuming) does not corp user credentials to authenticate and thereby subsequent provision/services wont be available.

Can anyone abuse the network without any credentials i.e guest mode

  • 2
    Can you rephrase the second paragraph? Do you mean that the visitor area doesn't have any network connection to the corporate network and therefore MAC restriction isn't necessary? – kaidentity Oct 13 '16 at 11:52
  • I'm assuming they are trying to achieve only allowing approved devices on the network, which is the whole point to layer 2 restrictions. – schroeder Oct 13 '16 at 12:03
0

There are many attacks that can be launched from Layer 2 that would provide credentials to a user that hasn't authenticated to the corporate domain ...yet.

For example, Responder is capable of spoofing LLMNR and NBNS requests even without being connected to the domain -based on the way NBNS (and subsequently LLMNR) were designed. They are enabled by default in most environments and IT needs to explicitly disable them (which is usually not the case). In that case, without MAC filtering a rogue device may be connected to the network via the meeting room jack and obtain network level access, from their there they could perform a variety of spoofing attacks. ARP poisoning is a related attack that could also be performed.

Additionally, abuse of the corporate Internet may also occur if just any device is able to connect to the network and receive Internet access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.