Yersinia: how to make your network administrator sick

Yersinia is the name of the plague bacterium. The tool lives up to its name: it attacks layer 2 protocols (STP, CDP, DTP, DHCP, VTP, HSRP) and makes your switch sick. The title of this article is not a metaphor: it is what actually happens to a network administrator who discovers that a workstation with Yersinia and a simple cable can take control of their switch topology.

The attacks, one per protocol

STP (Spanning Tree Protocol). Yersinia sends BPDUs claiming to be the root bridge with a lower priority. The switch recalculates the tree and traffic flows through the attacker’s workstation. Your switch has been re-rooted and all L2 traffic transits through the intern’s laptop.

CDP (Cisco Discovery Protocol). Yersinia injects fake CDP packets to make non-existent devices appear. The admin’s NMS starts mapping phantom switches.

DTP (Dynamic Trunking Protocol). Yersinia negotiates a trunk with the switch. If the port is in dynamic auto mode (the historical Cisco default), the switch accepts and the attacker sees ALL the VLANs crossing that port. It is the simplest and most devastating attack.

DHCP. Yersinia can saturate the DHCP server (discovering every available IP) or pose as a DHCP server and poison the clients.

VTP. Injection of VTP with a higher revision number and the admin’s VLAN database is overwritten. The entire VTP domain reconfigured by a laptop.

Your switch won’t save you

The root of the problem: layer 2 authenticates NOTHING by default. The switch believes what the port tells it. Yersinia exploits that natural trust of the network equipment.

The countermeasures, each one a line of Cisco config:

spanning-tree portfast bpduguard default
switchport port-security
switchport mode access (never dynamic auto)
no cdp enable (on access ports)

Each one closes one door of Yersinia. All four together close the building.

What it is worth

Yersinia is not for attacking the neighbor’s network (switches have countermeasures, you just have to enable them). It is for testing YOURS. If you administer a Cisco network and have never launched Yersinia against your own infrastructure, you do not know whether your countermeasures are active.

And the exercise is revealing: launch Yersinia, look at your switch and observe that the default mode is the vulnerable mode. Every countermeasure above must be enabled EXPLICITLY. Security is not the default, it is the configuration.