{"id":123,"date":"2026-10-28T15:27:07","date_gmt":"2026-10-28T15:27:07","guid":{"rendered":"https:\/\/www.boweaver.com\/?page_id=123"},"modified":"2026-10-28T15:27:07","modified_gmt":"2026-10-28T15:27:07","slug":"cracking-the-nac","status":"publish","type":"page","link":"https:\/\/www.boweaver.com\/?page_id=123","title":{"rendered":"Cracking the NAC"},"content":{"rendered":"<style data-wp-block-html=\"css\">\n\/* Cracking the NAC \u2014 scoped to this article only *\/\n.nac-article{--nac-blue:#13578c;--nac-ink:#182e3e;--nac-pale:#eff6fc;color:var(--nac-ink);font-family:inherit;line-height:1.72;max-width:1100px;margin:0 auto;padding:0 12px 48px}\n.nac-article *{box-sizing:border-box}.nac-article .nac-hero{background:linear-gradient(120deg,#101f2b,#123c59);color:#fff;padding:clamp(28px,5vw,65px);border-radius:14px;margin:10px 0 28px}\n.nac-article .nac-hero h1{color:#fff;font-size:clamp(2.2rem,5vw,4rem);line-height:1.12;margin:0 0 12px;font-weight:800}.nac-article .nac-subtitle{font-size:clamp(1.05rem,2vw,1.35rem);max-width:740px;line-height:1.5;margin:0;color:#e0edf6}\n.nac-article h2{color:var(--nac-blue);font-size:clamp(1.45rem,3vw,1.9rem);line-height:1.3;margin:34px 0 14px;border-bottom:2px solid #dcebf5;padding-bottom:7px}.nac-article p{margin:0 0 17px}.nac-article .nac-lead{font-size:1.1rem}.nac-article .nac-panel{background:#f4f9fd;border:1px solid #cbddeb;border-radius:12px;padding:22px;margin:25px 0}.nac-article .nac-panel h2{margin-top:0}.nac-article figure{margin:25px 0}.nac-article figure img{width:100%;height:auto;display:block;border-radius:10px;border:1px solid #c8ddeb}.nac-article figcaption{font-size:.9rem;color:#52697b;text-align:center;margin-top:9px}.nac-article .nac-two-col{display:grid;grid-template-columns:1fr 1fr;gap:25px}.nac-article .nac-steps{padding-left:1.4rem}.nac-article .nac-steps li{margin-bottom:12px}.nac-article .nac-note{border-left:5px solid #1b6eaa;padding:14px 18px;background:#eff6fc;margin:25px 0}.nac-article a{color:#135b9b}.nac-article .nac-end{font-size:1.12rem;font-weight:600}\n@media(max-width:720px){.nac-article .nac-two-col{grid-template-columns:1fr}.nac-article .nac-hero{padding:28px 22px}.nac-article{padding:0 2px 30px}}\n<\/style>\n<p><!-- Paste into a WordPress Custom HTML block after replacing both REPLACE_WITH... image URLs. --><\/p>\n<article class=\"nac-article\">\n<header class=\"nac-hero\">\n<h1>Cracking the NAC<\/h1>\n<p class=\"nac-subtitle\">How I bypassed network access control, reached a production network, and did it all from the parking lot.<\/p>\n<\/header>\n<section>\n<h2>Introduction<\/h2>\n<p class=\"nac-lead\">These days, companies spend a LOT of money trying to secure their networks. One of the technologies that&#8217;s become popular is Network Access Control, or NAC.<\/p>\n<p>Now, don&#8217;t get me wrong. NAC can be a useful security tool. It can help control what devices connect to your network, authenticate them, and sometimes check whether they meet a company&#8217;s security requirements.<\/p>\n<p>Sounds pretty good, doesn&#8217;t it?<\/p>\n<p>Well, there&#8217;s a catch.<\/p>\n<p>During a penetration test I performed, I came across a company that had installed NAC to protect its network. Employees had to authenticate their computers before connecting. But the company hadn&#8217;t thought through everything else plugged into the network, and that turned out to be a pretty big problem.<\/p>\n<p>For this article, I&#8217;ll call the company Widget Makers. The company name, network addresses, and diagram are fictionalized, but the penetration test and the weakness I demonstrated were real.<\/p>\n<p>The point isn&#8217;t that NAC is useless. It&#8217;s that you can spend a fortune on security equipment, but if you don&#8217;t understand how everything on your network fits together, you can still leave the front door wide open.<\/p>\n<\/section>\n<section>\n<h2>The Widget Makers Network<\/h2>\n<p>Widget Makers had a corporate network, CorpNET, and a production network, ProdNET, containing classified information. The networks were separate on paper, but traffic between them was not properly restricted. That meant a problem on the corporate side could become a problem on the production side.<\/p>\n<p>The company also used SIP phones and network printers. The phones were connected to the corporate network rather than being isolated on a dedicated voice network. Employee workstations had to pass the NAC checks, but certain other devices were allowed on through exceptions.<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/www.boweaver.com\/wp-content\/uploads\/2026\/10\/network-layout.png\" alt=\"Conceptual Widget Makers network diagram showing CorpNET, ProdNET, NAC-controlled access, SIP phone, and insufficient segmentation.\" loading=\"lazy\"><figcaption>Fictionalized network diagram. Addresses are examples, not the client&#8217;s real infrastructure.<\/figcaption><\/figure>\n<p>And that&#8217;s where things started getting interesting.<\/p>\n<\/section>\n<section>\n<h2>What NAC Does \u2014 and What It Doesn&#8217;t<\/h2>\n<p>Network Access Control is supposed to help decide which devices can join a network and what access they should receive. Depending on the product and how it&#8217;s configured, that might involve 802.1X, RADIUS, certificates, device posture checks, or an installed agent.<\/p>\n<p>Not every device can use the same authentication method. Printers, phones, cameras, and other equipment sometimes need special handling. Some can use 802.1X just fine; others end up using MAC Authentication Bypass, or MAB, or another exception.<\/p>\n<p>A MAC address is useful for identifying a network interface, but by itself it&#8217;s not strong proof that the device is what it claims to be. If you treat a MAC address like a password, you&#8217;re asking for trouble.<\/p>\n<p>That&#8217;s not a failure of every NAC product. It&#8217;s a failure of the security policy and the way exceptions are handled.<\/p>\n<\/section>\n<section>\n<h2>How I Found the Opportunity<\/h2>\n<p>While walking through the office during the authorized test, I noticed a cubicle with a calendar hanging on the wall. According to the calendar, the woman who worked there was on vacation for the entire week.<\/p>\n<p>Well, that was convenient!<\/p>\n<p>On her desk was a SIP phone connected to CorpNET. I knew from the network configuration I was testing that the phone was allowed on through an exception rather than the normal workstation authentication process.<\/p>\n<p>So I had an unattended location, a trusted device, and an exception in the access-control policy. Put those together and you have something worth testing.<\/p>\n<\/section>\n<section>\n<h2>How I Got Around the NAC<\/h2>\n<p>I disconnected the SIP phone and connected a WiFi Pineapple in its place. During the test, I configured the Pineapple to present the phone&#8217;s MAC address, then placed the device out of sight under the desk.<\/p>\n<p>The network accepted the device under the phone&#8217;s existing exception. I hadn&#8217;t compromised the NAC appliance or obtained an employee&#8217;s credentials. I had taken advantage of the way the network was configured to trust a particular kind of endpoint.<\/p>\n<p>And I wasn&#8217;t finished.<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/www.boweaver.com\/wp-content\/uploads\/2026\/10\/parking-lot-test.png\" alt=\"Illustration of the authorized test: a Jeep and laptop in a parking lot connect wirelessly to a WiFi Pineapple under a cubicle desk, with reachability from CorpNET to ProdNET.\" loading=\"lazy\"><figcaption>The test path, illustrated with fictional addresses. The Jeep is illustrative; the diagram is not a photograph of the client site.<\/figcaption><\/figure>\n<\/section>\n<section>\n<h2>From the Parking Lot to ProdNET<\/h2>\n<p>Once the Pineapple was in place, I went out to the company parking lot and connected to it wirelessly. I was now on CorpNET without running the NAC agent or authenticating as an employee.<\/p>\n<p>Remember ProdNET, the production network containing classified information? Because the company hadn&#8217;t properly isolated it from CorpNET, I was able to reach ProdNET from the parking lot.<\/p>\n<p>I ran Nmap against the production network and captured a screenshot of the results for my penetration test report. That gave me evidence of network reachability and the impact of the NAC bypass.<\/p>\n<div class=\"nac-note\">\n<p><strong>Important:<\/strong> Accessing classified data was NOT in scope. I did not access, retrieve, or examine any of that information. I demonstrated the network exposure and stopped within the authorized limits of the test. The original screenshot isn&#8217;t reproduced here.<\/p>\n<\/div>\n<p>Think about that for a minute. I was outside the building, wirelessly connected through a device hidden under a desk, and able to scan a production network that should not have been reachable from an unauthorized endpoint.<\/p>\n<p>The NAC was doing what it had been told to do. Unfortunately, the company had told it to trust something that was easy to impersonate.<\/p>\n<\/section>\n<section>\n<h2>Why It Worked<\/h2>\n<div class=\"nac-two-col\">\n<div class=\"nac-panel\">\n<h2>Access-control exceptions<\/h2>\n<p>The phone was treated differently from employee workstations. That exception became the opening. An approved MAC address was not sufficient evidence that the approved phone was still connected.<\/p>\n<\/div>\n<div class=\"nac-panel\">\n<h2>Network design<\/h2>\n<p>CorpNET and ProdNET had inadequate separation. Once I reached CorpNET, the lack of effective access restrictions allowed the test to extend to ProdNET.<\/p>\n<\/div>\n<\/div>\n<div class=\"nac-two-col\">\n<div class=\"nac-panel\">\n<h2>Physical opportunity<\/h2>\n<p>An unattended cubicle gave me a place to connect test equipment without immediately disrupting an employee who was at work.<\/p>\n<\/div>\n<div class=\"nac-panel\">\n<h2>Wireless exposure<\/h2>\n<p>The device created a wireless path back into the wired corporate network. That extended the exposure beyond the physical office space.<\/p>\n<\/div>\n<\/div>\n<p>None of these weaknesses had to exist together. But when they did, the impact was much greater than any one of them on its own.<\/p>\n<\/section>\n<section>\n<h2>How They Could Have Prevented It<\/h2>\n<ol class=\"nac-steps\">\n<li><strong>Segment the networks properly.<\/strong> Production systems should have their own security boundaries, with explicit firewall and access-control rules. Separate VLANs alone don&#8217;t help much if everything is allowed to talk to everything else.<\/li>\n<li><strong>Use stronger device authentication where supported.<\/strong> 802.1X and certificate-based authentication can provide stronger identity checks than trusting a MAC address alone.<\/li>\n<li><strong>Restrict exceptions.<\/strong> Devices that require MAC-based access should receive only the access they actually need. A phone shouldn&#8217;t have broad access to production systems.<\/li>\n<li><strong>Watch for unusual devices and changes.<\/strong> Switch-port telemetry, NAC logs, device profiling, and monitoring can help identify unexpected endpoint changes or wireless bridges.<\/li>\n<li><strong>Include physical security in the design.<\/strong> Unused ports, unattended workspaces, and exposed network jacks matter. Network security doesn&#8217;t stop at the switch configuration.<\/li>\n<li><strong>Test the whole path.<\/strong> Don&#8217;t just verify that the NAC agent blocks an unknown laptop. Test exceptions, the privileges those exceptions grant, and whether sensitive network segments remain protected after a foothold on a lower-trust segment.<\/li>\n<\/ol>\n<p>And remember, modern NAC systems vary quite a bit. Some can authenticate phones, enforce dynamic VLANs or downloadable ACLs, and profile devices. The lesson here isn&#8217;t that all NAC products are broken; it&#8217;s that security controls are only as good as their deployment and the architecture around them.<\/p>\n<\/section>\n<section>\n<h2>The Lesson<\/h2>\n<p>I&#8217;ve said it before: you can buy all the expensive security appliances you want, but they won&#8217;t make up for poor network design.<\/p>\n<p>In this test, the NAC wasn&#8217;t the only issue. The exception for the phone got me onto CorpNET, and the lack of segmentation let me reach ProdNET. Those were separate problems, and together they turned a local access-control weakness into a much bigger finding.<\/p>\n<p class=\"nac-end\">NAC can be a useful layer of security. Just don&#8217;t confuse another layer with a complete security strategy.<\/p>\n<\/section>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>Cracking the NAC How I bypassed network access control, reached a production network, and did it all from the parking lot. Introduction These days, companies spend a LOT of money trying to secure their networks. One of the technologies that&#8217;s become popular is Network Access Control, or NAC. Now, don&#8217;t get me wrong. NAC can [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-123","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.boweaver.com\/index.php?rest_route=\/wp\/v2\/pages\/123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.boweaver.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.boweaver.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.boweaver.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.boweaver.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=123"}],"version-history":[{"count":2,"href":"https:\/\/www.boweaver.com\/index.php?rest_route=\/wp\/v2\/pages\/123\/revisions"}],"predecessor-version":[{"id":125,"href":"https:\/\/www.boweaver.com\/index.php?rest_route=\/wp\/v2\/pages\/123\/revisions\/125"}],"wp:attachment":[{"href":"https:\/\/www.boweaver.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}