Network Security - securing network infrastructure and connections
8
votes
4answers
1k views
How can an access point spoof me into connecting?
I was reading through the answers of the question "How can I ensure that I connect to the right wireless Access Point?" and was wondering how it is possible for an access point to imitate another wifi ...
6
votes
2answers
1k views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
12
votes
3answers
1k views
Bruteforce attack on my FTP server
I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
11
votes
2answers
322 views
Network policies under AppArmor/SELinux
I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor.
I see that both SELinux and AppArmor allow the selected granting of socket level access ...
9
votes
1answer
558 views
Native rsync protocol security
Is the native rsync protocol (port 873) secure? Does it encrypt data or credentials?
I'm planning on using rsync to store encrypted files in the cloud, I'm wondering whatever the password is ...
8
votes
4answers
2k views
Looking for botnet IP address feeds to protect against DDoS
I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
0
votes
0answers
78 views
Pages restricted to certain IPs, safe? [duplicate]
Possible Duplicate:
In what scenarios is relying on source IP address as a security control acceptable/unacceptable?
If a website has a page which only renders for certain IPs, is there ...
12
votes
6answers
1k views
Are some uncommon TCP ports scanned less than others?
Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
6
votes
2answers
626 views
Is Access Control Through MAC ADDRESS a practical/secure solution
I run a small local gaming website with a custom admin panel I coded to let trusted members do administrative tasks through the software's API. Since their IP Address is dynamic, can I authenticate ...
5
votes
3answers
350 views
Solaris: IP Spoofing Across Ethernet Ports
Given a Solaris machine with two network interfaces corresponding to the separate ethernet ports in the back.
0: 192.168.0.5/255.255.255.0
1: 192.168.1.5/255.255.255.0
with /etc/defaultrouter set ...
5
votes
2answers
6k views
What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market
I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff.
So I ...
3
votes
2answers
1k views
When is it posible to sniff VPN traffic?
I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of ...
3
votes
1answer
117 views
How do I select a switch that protects against CAM attack?
Are there any flags/attributes, that I can see when buying an ethernet switch? I mean does it has a little message on the box of the switch, or any tech specs, from where i can see that the given ...
6
votes
1answer
487 views
I can receive all PADI packets for PPPoE connections of my ISP, is that a problem?
for debugging why my router wasn't connecting to pppoe i've tried to connect via the pc, it worked, then i started wireshark just to see what was going on, and i've seen that i can read all the PADI ...
7
votes
3answers
1k views
Alternative approaches to using DMZ for securing communication to and from external web server outside firewall
I am a software developer with little network security knowledge and almost no knowledge of the current network architecture for the environment I work in. If I had any, I still would not want to ...
3
votes
1answer
256 views
What kind of nefarious deeds can IP address Spoofing be used for? [duplicate]
Possible Duplicate:
What security risks does IP spoofing bring?
I found this article, which seems pretty good but was written in 2003 so I'm not sure how up to date it is.
Can IP address ...
7
votes
2answers
1k views
Strange STP traffic in my network, possible MitM attack?
I live at a student dorm, where we are connected to a student network. The administrators of this network have forgotten to disable STP broadcast on non-infrastructure ports.
Periodically, I lose my ...
6
votes
2answers
285 views
Design proposals for enhanced security for parts of Internet, e.g. for banking?
There is some recent discussion of some sort of "multilevel" internet, with e.g. a level defined for banking in which access is only granted after special authentication with "true names", special ...
2
votes
2answers
157 views
Which private-key encryption should I use for server to server communication?
I am tempted to write my own which covers:
Checksum to ensure data is not tampered with.
Long and multiple rotating keys so that it is (practically) impossible to decrypt.
Will use /dev/random for ...
5
votes
2answers
972 views
Can I block the true IP address using X-Forwarded-For header in IIS?
All the traffic gets to the IIS server through a proxy, I cant block or white list IPs, because all the traffic comes from the proxy's IP, Can I use the X-Forwarded-For header with IIS?
2
votes
1answer
373 views
How do Cisco devices identify routers?
Our network administrators forbid the usage of private routers in our college. They bought new Cisco equipment (routers, switches) which detect routers and automatically ban them (it disconnects the ...
1
vote
3answers
1k views
Ignoring broadcasts to 10.0.0.255 using iptables
I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:
$IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP
$IPTABLES -A FORWARD -d 10.0.0.255 -j DROP
It ...
5
votes
7answers
1k views
What security risks exist in cell phone apps' data transfer?
Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
0
votes
2answers
684 views
How do we protect our server from anonymous hacker? [duplicate]
Possible Duplicates:
Hardening Linux Server
How to best defend against Targeted Attacks?
I read this news: Anonymous hacker group hits Apple, publishes data
My question: How do we ...
8
votes
4answers
1k views
Is NTP vulnerable to DNS poisoning or spoofing attacks?
Scenario:
Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application)
Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...
6
votes
2answers
4k views
What is best practice for separation of trusted zones from a DMZ with a single firewall?
At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
6
votes
1answer
601 views
Deploying a campus WiFi network that authenticates against an AD LDAP
We are looking to deploy about 15-20 Cisco 1131ag access points on campus. I have been reading up on different authentication methods, but I don’t know what will be the best long term solution that ...
4
votes
1answer
174 views
Placing a firewall—without creating a new subnetwork
I have a couple of networks that have multiple IP addresses, and where I have absolutely no choice as to the equipment used for the network's edge router (the device that connects both to the LAN and ...
6
votes
2answers
1k views
Initial steps of network mapping
In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.
My Question
You ...
3
votes
3answers
310 views
Is vlan considered a security feature? [duplicate]
Possible Duplicate:
Why do people tell me not to use VLANs for security?
This topic came up in a discussion about network infrastructure, where a company had moved from separate physical ...
5
votes
2answers
957 views
How bad is the leaking of Internal IP addresses through external DNS
If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage?
Apart from most the obvious - gaining an understanding ...
10
votes
3answers
2k views
Can home routers get infected?
I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but ...
3
votes
2answers
231 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
5
votes
3answers
249 views
Forensics on a SOHO router
I am interested in how reliable the information determined from doing forensics on a SOHO router is. Most of these routers don't seem to be very advanced, so I question if it would be possible to ...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
0
votes
1answer
219 views
Is using a local DNS cache server more secure than using a DNS server from a router?
Is using a local DNS cache server imore secure than using a DNS server from a router?
4
votes
4answers
9k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
5
votes
1answer
2k views
Obtain credentials by spoofing WPA/WPA2 Enterprise network?
I have a large scale wireless network secured using WPA/WPA2 Enterprise authentication. Recently, I was made aware of the possibility that someone may use a dd-wrt router and a computer to spoof the ...
16
votes
2answers
418 views
In what scenarios is relying on source IP address as a security control acceptable/unacceptable?
I've noticed that there's a number of questions where relying on source IP address as a control gets mentioned and in most gets dismissed as being unreliable.
I'd be interested in hearing from anyone ...
0
votes
1answer
101 views
WLAN Router authentification [duplicate]
Possible Duplicate:
How can I ensure that I connect to the right wireless Access Point?
Is it true, that WLAN routers aren't authenticated by clients? The only "authentication" is SSID and ...
6
votes
1answer
452 views
How to get hold of and use WPA session keys?
I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I ...
5
votes
3answers
1k views
Resolving an IP address of a Remote machine to its MAC address
I wanted to know whether its possible to get the MAC address of remote node (computer/Access Point) if I know its IP address.
I have heard that if someone sends you an email (even through gmail), you ...
11
votes
5answers
359 views
How can citizens prevent government-led Internet blackouts?
The United Nations now considers Internet access a basic human right. [PDF]
Despite the questionable effectiveness of Internet blackouts in silencing a populace and preventing uprisings1, it's ...
12
votes
4answers
864 views
Threat assesment for a captive portal
I am interested in setting up a captive portal on a wireless network.
From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
12
votes
5answers
5k views
Security risk of PING?
I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
7
votes
2answers
444 views
Any advantage to securing WiFi with a PSK, other than to keep out unauthorized
As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key.
In which case, if you are not going to ...
6
votes
2answers
2k views
Private Tor networks: what are the benefits, and how would it be accomplished?
What are the benefits of someone building a private Tor network? ...One that is disconnected from the well-known network being used on the Internet at-large.
My intent is to make Tor more ...
7
votes
2answers
253 views
How do you Secure VOIP in a large organization
As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
7
votes
1answer
178 views
Trace large volume of web traffic, stopped at VPN
I have a web server. I recently received a large volume of web traffics, after tracking it down, it is coming over a commercial VPN provider. Is there any way to keep the tracing going, beyond the ...
5
votes
4answers
155 views
software to keep a list of IP that try to access ssh over a set of rules and feasibility
i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like:
one attempt to log as ...
