Network Security - securing network infrastructure and connections
6
votes
2answers
2k views
Private Tor networks: what are the benefits, and how would it be accomplished?
What are the benefits of someone building a private Tor network? ...One that is disconnected from the well-known network being used on the Internet at-large.
My intent is to make Tor more ...
7
votes
2answers
255 views
How do you Secure VOIP in a large organization
As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
7
votes
1answer
179 views
Trace large volume of web traffic, stopped at VPN
I have a web server. I recently received a large volume of web traffics, after tracking it down, it is coming over a commercial VPN provider. Is there any way to keep the tracing going, beyond the ...
5
votes
4answers
155 views
software to keep a list of IP that try to access ssh over a set of rules and feasibility
i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like:
one attempt to log as ...
4
votes
2answers
946 views
incoming packets in server
I have enabled iptables logging for packets coming from the outside
-A INPUT ! -s 192.168.218.0/24 -j LOG
Now i am seeing lots of incoming packets from unknown addresses
Jun 5 14:54:56 localhost ...
4
votes
1answer
154 views
Store To Store communication through MPLS VPN
In a PCI environment with an MPLS VPN network setup should you allow store to store communication?
Do you think that an MPLS network would be consider secure enough for this? why or why not?
7
votes
6answers
214 views
Why shouldn't I run other applications on a Firewall?
If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)?
The only opened port to the world (wan ...
1
vote
2answers
299 views
Is the level of traffic normal against my blocked ports?
I was recommended by my brother to direct the question here about the level of traffic I get against several of my blocked ports.
I run pfsense 1.2.3, router in bridge.
Behind pfsense I have:
1x ...
7
votes
1answer
1k views
Bypassing hidden SSID and MAC filtering “protection”
I was browsing over this question and had some follow up questions from a practical perspective.
What tools will show the SSID of an AP with the SSID set to hidden or broadcasting disabled? I have ...
3
votes
7answers
428 views
Determining network topology from the outside
To what extent can an attacker generate a map of a network from outside of it?
Are network scanning tools such as nmap the only means to do this? Otherwise what other types of tools or techniques ...
0
votes
1answer
77 views
Windows network specific attacks
I have limited experience with Windows networks and certainly no experience with AD forests or anything related.
I have experience and understanding how to secure and maintain a unix style network.
...
5
votes
1answer
179 views
Secure access to a Microsoft Access Database
I have a server set up with medical files in a Access database.
I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system. I can find out specific ...
8
votes
2answers
975 views
Bypassing a reverse proxy/NAT
Reverse proxies and NAT would seem to obscure a network behind such technologies to the point where it would be hard if not impossible to identify ports open and services running.
Given that many ...
5
votes
3answers
370 views
Best practice for creating an initial IPS policy
I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and ...
2
votes
1answer
138 views
Can a bad guy be judged for gaining access to sensitive information?
Assuming a hacker has sent to somebody a malware. It's a trojan (digitally signed by TeamViewer) which runs automatically when windows starts up and sends the login info to a web site using GET ...
0
votes
2answers
2k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
13
votes
3answers
2k views
Recommendations for honeypot software
A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
6
votes
2answers
675 views
IIS IP Adress Restriction - can I rely on it online?
I've been told that I might have more luck posting here than on Stack Exchange, so here goes:
I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no ...
13
votes
1answer
487 views
Are there any security problems with Google false start for TLS?
Google recently announced false start in Chrome browsers which increased TLS performance by 30%
http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml
I know TLS has been poked ...
6
votes
3answers
391 views
wlan security - why is it not possible to protect against deauthentication flooding
Wireless security (Wikipedia) describes security issues due to the fact that wi-fi deauthentication packets are unencrypted:
Weak PSK passphrases can be broken using off-line dictionary attacks by ...
6
votes
3answers
937 views
Risk of configuring MySQL for remote access with a dynamic IP address?
I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
5
votes
2answers
367 views
What are the risks associated with relying on IPSec IP Filtering?
When using Windows IPSec for IP filtering whenever a filter is added you need to have a "mirror" rule (by checking the "Mirrored. Match packets..." tickbox).
Because IPSec Filtering is not stateful, ...
0
votes
2answers
162 views
How to find out the Chaff packets of WEP?
I have a cap file in which i have lots of 802.11 packets encrypted with WEP key. The problem is lots of Chaff packets of WEP is included in that. I want to remove the Chaff packets and crack the key. ...
5
votes
5answers
377 views
Is there a way to identify the host of a malicious VM from across the network?
Scenario:
Someone is attacking your network. However, they're not exactly using their machine to do it - they're using a VM running on their system. The VM's network adapter is configured in ...
6
votes
1answer
274 views
What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?
What are the main issues and recommended controls when exposing SIP and H.323 to the Internet (could be for voice, video, and instant messaging traffic or all three)?
Specifically I'm looking for ...
7
votes
1answer
137 views
Long running SMTP session
I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so ...
11
votes
2answers
11k views
What is the real function and use of a DMZ on a network?
I read the article on Wikipedia describing what a DMZ (demilitarized zone) is on a network, but am still failing to grasp both how it is set up (ie: is it within the main network or sequestered away?) ...
10
votes
5answers
8k views
How to find out that a NIC is in promiscuous mode on a LAN?
How to find out that a NIC is in promiscuous mode on a LAN?
7
votes
4answers
1k views
extract from pcap all protocols found
I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark
I think tshark is able to do it, but ...
4
votes
4answers
924 views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
8
votes
4answers
363 views
CAM table attack in 2011?
Today's switches are vulnerable to CAM Table attack?
https://secure.wikimedia.org/wikipedia/en/wiki/CAM_Table
5
votes
4answers
466 views
What is War Dialing?
The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?
5
votes
1answer
363 views
What is the value of encrypting a payload when it will be transferred over sftp anyway?
We have a integration arrangement to send content across the internet and the agreed protocol encrypts then sends it via sftp.
What possible reason coould there be to encrypt the content twice?
I ...
2
votes
2answers
205 views
ip-fragmentation and mod_security?
is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security?
the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
4
votes
3answers
415 views
Books on Cryptography, with a focus on application to Network Security?
Looking for some nice text books in the field of network security as part of my course. Our course covers mainly tls, ssl, pgp, smime, vpn, md5, hmac ....
6
votes
3answers
330 views
IP Address spoofing?
According to:
https://secure.wikimedia.org/wikipedia/en/wiki/IP_address_spoofing
"this technique is mainly used when the attacker does not care about the response or the attacker has some way of ...
5
votes
1answer
595 views
TLS at layer 4 BUT 802.1X EAP-TLS at layer 2?
In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine.
Port security 802.1X and EAP is a data link layer 2 ...
3
votes
2answers
255 views
loadbalancer, 2 webserver, 1 webserver hacked , how to tunnel out?
lets say i have one loadbalancer (haproxy) and two webservers
one gets hacked.
is the attacker able to make outgoing connections when the webservers have no direct internet access (only ubuntu update ...
4
votes
4answers
666 views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
4
votes
2answers
889 views
Cisco IOS question - password management, service password encryption types
I'm university student studying for my certification exam, and I was doing some reviewing today when I found a question that I can't find an answer to.
Basically, in the CCNA3 2.4.1 Cisco Netacademy ...
2
votes
1answer
242 views
IP Conflicts / Spoofing
Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ?
Can TCP stack 'shutdown' or stop in order to protect itself ?
2
votes
1answer
390 views
IPV6 Cryptographically Generated Address implementation
I am looking to an Cryptographically Generated Address (CGA) implementation in Java or in C++.
Would be glad if someone can help.
10
votes
2answers
1k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
5
votes
1answer
355 views
Reasons behind MAC Spoofing on a corporate network?
My team is inspecting some MAC Spoofing events that are triggering in our corporate environment. After talking it over with the team, this is the information that we have that is relevant....
The ...
13
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
4
votes
3answers
259 views
Information gathering before deploying a Network IPS
I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
6
votes
1answer
883 views
Security Operation Center (SOC)
I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
4
votes
4answers
593 views
Are there consumer-grade VPN services that support two-factor authentication, like SecurID?
I'd like to increase my VPN security, and Google hasn't turned up anything with regard to VPN services and SecurId.
Does anyone know of services like this?
2
votes
2answers
189 views
DNS access limitations
Im working on a script that's going to talk to a DNS on a LAN that have information about local domains. And I believe its blocking my requests.
So my question is: How can you limit a DNS server to ...
1
vote
2answers
566 views
Cisco ASA Default Route Issue
We have a test environment which mimics our enterprise network security design. In this test environment my team and I would like to bypass our DMZ entirely. This seems easily enough done by simply ...
