I'm currently doing a penetration test for a client, who are using Trustwave NAC to prevent unauthorized physical access to their network.
I would like to know if there are any possible ways to bypass this. Client is putting a lot of faith in their implementation (with good cause so far), but I would like to be able to bypass it if possible to demonstrate, if nothing else that reliance on a single security technology is not a good solution.
Short of trying to DOS the device (I have permission to try this), I'm not sure what could be attempted.
This device does is not simple port security. It uses ARP poisoning to hide the actual gateway, and puts all devices in a quarantine LAN until they are authenticated against an Active Directory server. Spoofing a MAC of someone else in the quarantine LAN will not help, unless I can also trick the NAC device into think I was a device that had previously authenticated against AD.
Looking for known techniques, academic papers, conference presentations etc.
@MAC → @IP
. Start investigation (Wireshark, tcpdump…) by analysing the initial traffic of an@MAC
which is the most talkative. Since this software is agentless, everything is played on the wire. Since everything can't be broadcasted, you will have to start stealing valid@MAC
when they are off (to avoid easy duplicate detection). – dan Jul 8 '14 at 9:54