OSPF hello seen in my PC

[shirleyg]

Hi guys, I'm the new IT guy in a university, I just installed Wireshark to check network traffic and I saw some OSPF hello messages, it seems passive interfaces have not been configured, I thought...is this enough to infiltrate into the network and join the OSPF network 10.0.0.1? and to my surprise it was....I installed GNS3 and imported a vios image, I connected it to the physical network and got an adjacency, I was able to see hundreds of networks 192.168.0.1, it turns out that there was no authentication configured either.....

So, no passive interfaces, no authentication and all networks in a single area (I was able to discover all subnets they use for 10 other branches including the central building).

How common is this to find? I can't believe there are so many lazy network engineers that have 10 to 20 years of experience and are unable to check misconfigurations like this one....

[Harold Ritter]

Hi @shirleyg ,

This is more common than you would imagine. Network engineers don't always have security in mind, as you discovered.

I used to support a large financial customer and one of their engineers plugged in a router to the ethernet port at their desk. The router was configured to advertise the default route to the network. The router established a neighbor relationship and started advertising the default route to the corporate network. It obviously caused a major outage, which should have never happened.

Regards,

[MHM Cisco World]

The network protect to not allowed anyone outside to access and check such as these data, but you are from home so you get already Permeasion to access data. 

But IT also must thing about this there is auth of ospf and opsfv3 have encrypted for messages, but this also cant apply every where, the router decrease it throughput foreach encryption it done, we use encryption out but between router insides no I dont think so.

Again we put key for outside door but we dont put key for living room or kitchen doors. 

MHM

[ammahend]

These issues are commonly detected in cybersecurity and IT audits that most universities go through once a year, so it not very common that using an access port one can get to where you got. But I can't say I haven't seen OSPF deployments with no password and no passive interface. You should bring this to attention of right people and suggest an IT security audit to be done.

[nednakbapl]

Hi guys, I'm the new IT guy in a university, I just installed Wireshark to check network traffic and I saw some OSPF hello messages, it seems passive interfaces have not been configured, I thought...is this enough to infiltrate into the network and join the OSPF network? and to my surprise it was....I installed GNS3 and imported a vios image, I connected it to the physical network and got an adjacency, I was able to see hundreds of networks, it turns out that there was no authentication configured either.....

So, no passive interfaces, no authentication and all networks in a single area (I was able to discover all subnets they use for 10 other branches including the central building).

How common is this to find? I can't believe there are so many lazy network engineers that have 10 to 20 years of experience and are unable to check misconfigurations like this one....

[Joseph W. Doherty]

Unfortunately, consideration of security is often overlooked in many aspects of IT, not just networks.

Possibly there's laziness involved, but more often I've found its due to lack of knowledge.  (Hey, why you think we have certifications for "security"?)

Also, sometimes (rarely) it's a "conscience" decision.  I.e. in some cost benefit analysis, the cost of doing it, and supporting it, is considered more than the potential negative impact cost.

In a university environment, it's possible only the student networks are so open.  Possibly, faculty and admin networks are better secured.