Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

9
votes
3answers
559 views

Would publishing a network diagram make the network less secure?

I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration. Does sharing this type of information decrease the security of my network? ...
-3
votes
3answers
185 views

wireless security concern [closed]

My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
2
votes
4answers
459 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
2
votes
1answer
80 views

Seeing outboud connections to random domains, how do I isolate the app responsible?

Last night I loaded up Fiddler2 to do a little debugging and I saw three connections to domains like hghefhhig How can I go about isolating the application responsible? I was thinking possibly ...
0
votes
2answers
107 views

Display all packets but not these TCP packets? [closed]

I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do: tcp.dstport != 3389 && tcp.srcport != 3389 It would ...
6
votes
6answers
5k views

How to detect eavesdropping by your ISP

I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss. I know how to get around this online, use a ...
7
votes
2answers
219 views

How serious is a local virus in terms of network security

My colleague got a notification on his machine of a possible virus (through the virus scanner that is installed by default on all machines). He called up the tech department, and they simply told him ...
2
votes
1answer
191 views

What security risks are involved with sending data over the internal network on Rackspace Cloud servers?

What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers? Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
9
votes
1answer
15k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
31
votes
9answers
20k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
-1
votes
2answers
156 views

How much chance does an attacker have in this situation?

nmap -p- IPADDRESSHERE shows no opened ports for a router from public interface (router is an openwrt machine). It drops all ICMP and only has IPv4 address (the only thing that it runs on public ...
3
votes
1answer
742 views

Identifying device based on the MAC address

Suppose we know that MAC address A belongs to a certain device (say an iPhone 5), and MAC address B also belongs to an iPhone 5. If we have a MAC address C which is in between A and B, does this ...
1
vote
3answers
921 views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
1
vote
1answer
416 views

How to write Snort rules based on MAC address?

I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
2
votes
3answers
220 views

Passwords In Securing Network Devices

I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on ...
1
vote
2answers
1k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
2
votes
3answers
1k views

DDoS on LAN: How to Defend?

DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...
2
votes
2answers
311 views

Attacks surrounding /etc/hosts/

Although /etc/hosts/ is a file that comes up a lot in security, I am surprised to find there is no discussion here on this forum that describes how this can be used for an attack. Thinking about it, ...
3
votes
2answers
327 views

Which ports are potential security risks for nmap?

I'm using nmap and I am having trouble finding which ports are dangerous and pose the greatest security risks. Which ports are potential security risks for nmap? I was thinking samba, telnet, vnc ...
4
votes
1answer
330 views

Accurately mapping networks for purposes of pentesting

I always love staring at those network topology diagrams you see posted up in schools and online. Obviously if you physically setup and configured everything, plotting out servers, subnets, routers ...
8
votes
1answer
213 views

Are multiple network interface still recommended in a virtualized world?

Before the virtualization era, it was recommended to have several network card on a physical server : 1 for production dedicated network (only application's stream like http, SQL*NET, ...) 1 for ...
2
votes
1answer
7k views

How does pfsense block torrent traffic?

I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
2
votes
3answers
404 views

Repudiation in Copyright Infringement (BitTorrent)

Seeing this question : How can alleged illegal downloading be detected? sparked a question I have had for a long time. How does repudiation/non-repudiation work in such cases ? Argument: It is known ...
1
vote
3answers
798 views

How can alleged illegal downloading be detected?

Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method? Update Using a honey pot or monitoring the peers list makes ...
10
votes
3answers
1k views

Is a predictable MAC address a risk?

If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
6
votes
1answer
179 views

Parabolic Denial Of Service — Would it work?

Would this DoS attack be effective: Attacker determines target (10.0.0.1) Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1 Servers reply to 10.0.0.1 with syn packets ...
1
vote
3answers
848 views

using network switches to prevent malicious promiscuous mode usage

I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode. In the ...
9
votes
2answers
511 views

How does the Copyright Alert System work? Who has implemented it?

Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright. I'm concerned how this oversight relates to my private traffic, and what laws ...
6
votes
2answers
512 views

What risks does WPA carry?

A family member of mine would like to be able to play old PSP games online. Unfortunately the device does not support WPA2, and my network is strictly WPA2 AES secured. What are the risks involved in ...
2
votes
1answer
548 views

Password authentication using DynamoDB

I'm working on a Mac app. I have users stored using DynamoDB. Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
5
votes
2answers
925 views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
43
votes
2answers
20k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
2
votes
2answers
326 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
8answers
27k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
3
votes
1answer
341 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
3
votes
3answers
426 views

Privacy issues in Peer to Peer networks

In any typical P2P file sharing app, say DC++, the typical operations are search content, push content and pull content. A peer node broadcasts/multicasts its query to fellow peers and receives ...
1
vote
1answer
2k views

By default, does a linksys router log connections?

Routers have many settings that allow it to be safe and secure for the users that are connected to that network. A lot of these settings have to be manually configured though, which includes ...
3
votes
2answers
497 views

Dirty and clean interface on DMZ gateways

We have a webservice border gateway in DMZ which handles incoming and outgoing webservice requests in terms of authentication and security. We have two network interfaces in place, on is called ...
5
votes
3answers
606 views

Does NAT break source port randomization?

The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests. Does NAT break the security benefits of source port randomization? In more detail, consider ...
-1
votes
2answers
391 views

Precautions to be made while using Internet chat to prevent being hacked? [closed]

I have read many websites which state that, "We can hack into computers while chatting on the internet." What are the best precautions to be taken while chatting to prevent unauthorized access? I ...
2
votes
1answer
346 views

Best way to validate /etc/hosts from third party providers to avoid ads?

A lot of people use a huge /etc/hosts file to simply redirect ads and scam sites to 127.0.0.1. The interesting part about this approach is that you can have the same hosts on your tablet, your android ...
2
votes
2answers
1k views

DMZ and LAN data exchange - what direction should connections be made?

When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure: DMZ service pushes data to LAN service or LAN service pulls data from DMZ ...
4
votes
3answers
3k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
0
votes
1answer
237 views

adsl modem with the most security features [closed]

I am looking for the adsl modem with the most security features available. A 'least likely to be compromised', can be configured to be hack proof adsl modem with an internal firewall and other ...
1
vote
2answers
168 views

IP attack by reading/writing data?

If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection). Are there any further/more dangerous ...
-3
votes
1answer
299 views

How can cellular phones be eavesdropped on? [closed]

I know its really stupid question but one of my friend told me that he can listen to the guy who calling on his mobile phone without his phone being the one the call is controlled by. What ways could ...
5
votes
4answers
1k views

Ways to monitor someone's internet traffic

If some authority for whatever reason decides they want to monitor your traffic on a wired DSL connection, how would they do it besides exploiting your OS? What are the other ways assuming the OS is ...
11
votes
1answer
520 views

XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?

In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
2
votes
3answers
1k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or ...
2
votes
2answers
375 views

AES CBC over TCP - when is new IV needed

I am working on a project where two devices will be communicating with AES with CBC over TCP. We already have a secure mechanism for sharing the encryption/decryption key. I am not sure if we need to ...