Skip to content

NAC bypass (802.1X)

1. Context & stakes

Bypass 802.1X network access control.

802.1X keeps a switch port closed until the endpoint authenticates, but many deployments authenticate only at link-up and then trust the MAC forever. An attacker bridges behind an authenticated device, or spoofs its MAC once it leaves, to inherit the authorised session. This authenticate-once, trust-forever gap is why MACsec-bound 802.1X and continuous posture checks exist.

2. Theory

802.1X gates a switch port until the device authenticates (EAP over LAN) to a RADIUS server. The MAB fallback trusts a device's MAC, so cloning a printer's MAC opens the port. Because 802.1X only authenticates at association, an attacker can also insert a hub behind an authenticated host and ride its authorised link.

3. Attack (PoC)

netlab-8021x attack --i-own-this-network --iface veth-host
  1. MAB spoofing: clone a trusted device MAC (printer)
  2. Out-of-band hub injection behind an authenticated host

4. Detection

netlab-8021x detect --iface veth-host

Indicators to watch, and the associated IDS rule (see netlab-ids).

5. Defense

  • Dynamic device profiling
  • MACsec (802.1AE) link encryption

6. Exercise

Reproduce in the isolated lab (netns/veth): see lab setup.

7. Further reading