Tagged Questions

Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

2
votes
3answers
4k views

How do I diagnose client-side SSL errors?

Often on my home network I get random SSL certificate errors when I visit certain well-known sites. Today it was a Google SSL error, where Google apparently tried to identify itself as *.icloud.com. ...
4
votes
1answer
137 views

Suggestions for secure fax SaaS

Does anyone have experience with any fax cloud services, which they can recommend from a security standpoint?
2
votes
2answers
865 views

Does “loose source and record route” drop the source address?

Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur? It ...
14
votes
2answers
543 views

Why on earth would anyone use the 'top secret' option of IPv4?

So, I was reading RFC 791, and got to the bit about options (here). Everything seemed to be decent and sensible, until I got to the 'levels of security' part. Now, I can understand how, internally, ...
8
votes
3answers
3k views

Security measures for a WiFi access point?

I am planning to purchase a program that comes with an App that allows you to control the program via phone. The developer told me that the connection will be done via an extra WIFI box connecting to ...
4
votes
5answers
1k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
6
votes
4answers
757 views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
2
votes
2answers
3k views

do different subnet masks on home network provide any security?

So I have two routers on my home network: one is provided by my ISP, and the other is my private router. Router A- ISP router: 192.168.1.x router B- private router: 192.168.2.x Clients on my ...
1
vote
2answers
300 views

Intrusion Prevention Systems: NIPS vs NBA

I was going through the wikipedia article on Intrusion Prevention Systems. It states two of the four types of IPS as follows: Network-based intrusion prevention system (NIPS): monitors the entire ...
4
votes
3answers
2k views

How will IPv6 affect DDoS mitigation techniques?

IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks. What are some examples of risks and mitigations? For example, ...
6
votes
1answer
4k views

Exchange of DEK and KEK (encryption keys) between app server and key server

In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
3
votes
2answers
480 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
-1
votes
1answer
810 views

Can File Sharing being Controlled by Mac Address? [closed]

I am currently setting up secure environment between 2 pc in isolated network. Just wondering can we do file sharing based on that pc mac address instead of username? The environment is OEM Windows ...
3
votes
1answer
1k views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
1
vote
1answer
329 views

Tor traffic seems to be exiting from different Tor exit nodes - is that expected?

I seem to be observing some odd behaviour whilst experimenting with TOR. It's entirely possible this is just my own ignorance as well, in which case I would appreciate some ...
5
votes
1answer
647 views

Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice

I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
5
votes
2answers
323 views

How did Evernote detect the security breach?

http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ Evernote's official message says little about technical details of the attack and how it was detected. ...
5
votes
2answers
449 views

Segmenting Virtual Network Traffic

I have a basic to moderate understanding of VLAN's and their pros and cons as they relate to network segmentation but I'm wondering where to start as one moves into virtualized environments. From a ...
3
votes
1answer
1k views

Tacacs+ scenario: can I permit user to configure only for one interface and deny others

I'm currently deploying TACACS+ with a Cisco device, I use a TACACS server from here: http://www.shrubbery.net/tac_plus/ My scenario is: I want to permit a user to configure my router but only for a ...
14
votes
4answers
12k views

How are spoofed packets detected?

My assumption: When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
1
vote
4answers
498 views

How does one go about network forensics investigation with no prior knowledge?

I am being asked to perform a forensics investigation on a network. The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
1
vote
0answers
156 views

Which are appropiate tests to perform during an internal/LAN security audit? [closed]

In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.) Which are ...
0
votes
1answer
170 views

All I see is RPC, how do I proceed?

I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise. The machine was only running ...
3
votes
1answer
251 views

Is RDP an effective security barrier

If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
1
vote
2answers
130 views

non-periodic event detection

I'm searching for keylogger detection. As far as I see, almost all of keyloggers created by tools are sending data to a host periodically, but the ones made by coders may send data non-periodically. ...
1
vote
1answer
83 views

Does pppd encrypt traffic?

There is pppd program that can be used to create point-to-point conections over various channels (including other network). It supports authentication and compression. But does it encrypt traffic or ...
0
votes
1answer
184 views

MACSEC nonce/key uniqueness

802.1ae requires a nonce to be sent with each Ethernet frame in the MACSEC tag. The 96 bit nonce is formed by concatenating a 64 bit fixed field (based on MAC source address and port number) with a ...
3
votes
5answers
214 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
4
votes
3answers
4k views

How do you detect load balancing?

Scenario You need to PenTest XYZ.com. You expect, because it is a high traffic site, that multiple servers are being used with a load balancer. Question Aside from pulling the MACs (which are ...
1
vote
1answer
224 views

Packet-filtering firewall evasion (Scanning)

Context I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
2
votes
2answers
2k views

What is more risky? Database Server in DMZ or Trusted Network?

Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently. Assume the following A web server is being used for ...
3
votes
2answers
3k views

Protecting against SSL Strip [duplicate]

I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe? Does it depend on the cert strength? Do you ...
2
votes
2answers
581 views

keylogger detection by listening network

It is known that malware often uses keyloggers. Also some viruses aren't detected by antiviruses, therefore some viruses, especially APTs could stay in a system for so long without any detection. What ...
1
vote
1answer
278 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...
15
votes
3answers
15k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
24
votes
6answers
86k views

If someone hacks my wi-fi connnection, what can they see and how?

I have two questions on wifi security: If someone knows my wifi password (be it WEP or WPA) what can they see on my screen? Do they just see URLs I visit, or can they see everything in my ...
3
votes
3answers
12k views

How to tell if you're being ARP poisoned?

I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios: Over WiFi bridge pluged into cisco router to took ...
6
votes
2answers
184 views

Are temporary blocks sufficient response to network probes?

We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time. ...
28
votes
1answer
135k views

Why can you bypass restricted WiFis by adding “?.jpg” to the URL?

I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
1
vote
2answers
643 views

What type of data does Snort log?

This is new to me, but what types of data does Snort log for Network Intrusion Detection? I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
8
votes
2answers
8k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
1
vote
2answers
146 views

Wifi box produces three SSIDs?

While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
-2
votes
5answers
3k views

How can I configure my router to prevent connections bypassing it?

I am trying to configure my router to control access for several of my devices at home. I am currently using a linksys router. Our home consists of three devices (a desktop, a laptop, and a ...
1
vote
1answer
353 views

Is suspicious network activity likely to be caused by a rootkit?

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass ...
19
votes
1answer
4k views

What are darknets, and how can they be used to provide security and anonymity in network communication?

One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
3
votes
5answers
1k views

Building my own Darkspace

I have searched through the internet about creating a darknet and there is a confusion. There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
2
votes
2answers
297 views

Analyzing Network Anomalies for Malicious events

For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies. Our main ...
0
votes
1answer
1k views

DrayTek Vigor 2920 HTTPS allowed

In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups. This all works fine, however we've discovered that all HTTPS ...
10
votes
4answers
5k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
5
votes
1answer
126 views

Symbiote Counter-Attack Detection

I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...