Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

71
votes
3answers
81k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
-1
votes
1answer
60 views

Using old router as wi-fi extender/extra security on shared network?

I just moved into a building with three apartments, all of which split an internet subscription. There is only one router, however, in one of the other apartments. For security/privacy purposes, I'd ...
5
votes
2answers
114 views

Set up a system to sandbox/capture outbound traffic from Windows PC?

Does anyone know of a program/system that is purpose built to allow you to sandbox/contain an outbound connection from a Windows PC? The aim being that you can analyse the data being sent via the ...
1
vote
1answer
53 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
4
votes
0answers
51 views

Identify malicous hosts in our network by sending valid domain credentials

We are currently whitelisting the hosts owned by our company on our Cisco switches to prevent private hosts in our network. This works pretty well but someone can still spoof the MAC address of his ...
3
votes
3answers
109 views

VPN server in a router [closed]

I am new to using and configuring VPNs. I was thinking of setting up my router as an OpenVPN server, but as I understand that is to connect form the outside to my network. However, I want a connection ...
4
votes
1answer
265 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
25
votes
2answers
5k views

How can my IP camera be hacked behind a NAT?

I keep reading about hackers accessing laptop and home security camera systems. Most home users are using SOHO routers meaning they are on a private IP range behind a NAT. I realize NATs aren't ...
0
votes
1answer
78 views

What path (programming language, courses) should I take inorder to become a network/ security developer. (Not network configuration)? [closed]

I would want to work in network and network security field as a developer(programmer),developing network products(not network/network product configuration) ultimately to get into network security ...
34
votes
3answers
5k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
1
vote
1answer
557 views

Can you sniff broadband connections? And how you secure that?

I know that you can sniff data which is transferred over wifi. Can you do that with broadband (wired)? And how can you secure the network, so nobody could sniff data both over wifi, and broadband?
0
votes
2answers
64 views

See the traffic from my own Android phone

My employer (a Dutch university) gave me an Android phone. I am not allowed to root it. Still I want to know what traffic goes through it. Also I want to protect myself when I am in public places. ...
0
votes
2answers
104 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
1
vote
1answer
46 views

Is rootkit detection by comparison of file, process and connection lists a good practice?

I'm currently reading the Blue Team Handbook and one of the recommended methods to detect rootkits is to compare technical data obtained from various sources. As I understood it this is practiced like ...
1
vote
2answers
5k views

Is it dangerous to use hamachi for sharing game servers

I'm sure most of you are aware of a game called Minecraft. Well a lot of people like to host servers, however many are unable to port forward or pay for hosting so they download and use a piece of ...
0
votes
1answer
55 views

Following strategy using DDoS mitigation service - UDP bandwith exhaustion attack from spoofed IPs

I need to defend against receiving a massive spam of UDP packets from random spoofed IP addresses. I would make it this way: In my protocol, every UDP packet contains username and password. Firewall(...
0
votes
2answers
255 views

Kali Linux/Metasploit in VirtualBox - Issue with ports

I've been attempting to get port 4444 to open these past couple of days. I finally figured I'd try to get it working on my Windows machine first and I finally got it. Now, no matter what I do in the ...
0
votes
1answer
104 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
0
votes
1answer
332 views

Could other people steal my Internet connection if they had my PPPoE data?

Would it be possible for other people to use my PPPoE data to get Internet access or is it somehow restricted to my house? Then what about my neighbors downstairs, could they do it? And what about ...
22
votes
2answers
864 views

Why on earth would anyone use the 'top secret' option of IPv4?

So, I was reading RFC 791, and got to the bit about options (here). Everything seemed to be decent and sensible, until I got to the 'levels of security' part. Now, I can understand how, internally, ...
42
votes
5answers
44k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
1
vote
3answers
58 views

When is IP blocking OSI level 7 only and what is the purpose of doing so on multiple locations?

Let's say there is an application that has IP whitelisting, all other IP's are denied. This check takes place on three different locations: iptables, .htaccess, PHP script. Now in what OSI layers ...
0
votes
2answers
63 views

Do any open-source firewalls support remote management? [closed]

Remote management is essential if you have to run more than three network devices, and is supported by all commercial firewall products. For example: Palo Alto Networks: In addition to control ...
0
votes
1answer
39 views

How do you shun an IP automatically based on the number of current connections?

If I have a single IP that's trying a Denial of Service attack, how can I automatically have it banned/shunned? I go in and manually put it in a group of banned IP addresses, but I'd like for it to ...
0
votes
1answer
52 views

Does ARP or DNS spoofing play a role when performing MITM in fake AP attacks?

I have a test environment, where I try some wireless hacking tools and approaches, and lately I have been interested in evil twin attacks. I created a fake AP using airbase-ng, and specified the IP ...
1
vote
3answers
81 views

Is SSL Interception possible without disabling Public Key Pinning on the client side?

I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites. But there are some sites which use HTTP Public Key Pinning to prevent MitM ...
4
votes
4answers
24k views

How does Team Viewer establish a Remote Desktop Connection?

I am wondering how is it possible for Team Viewer to establish the remote desktop connection over the internet even if the user has not enabled the 3389 port ? I am searching over the internet but ...
5
votes
2answers
230 views

What information could be identified about a Virtual Machine which routed traffic via a VPN?

Background: I have a Virtual Machine which is running all it's traffic through a VPN (from within the Virtual Machine) so to obfuscate all web traffic. This Virtual Machine is running from within an ...
0
votes
0answers
8 views

FID on iPad app on non company network

I am planning to implement SSO for one of company iPad apps. The app will never be on an App Store but instead loaded with third party authentication. The users on iPad will rarely be on the company ...
0
votes
1answer
18 views

Default GW IP address shared with management interface IP: any securirty implications?

Building out separate VLAN for management interfaces. The proposition is to use Default GW IP address as a management interface for network device. Any security concerns?
0
votes
1answer
95 views

Why does DNS Spoofing not working on HTTP ,HTTPS Sites? [in my case]

I am trying to perform a DNS spoofing attack, but the confusing thing is that when I'm performing the attack on HTTP sites, nothing happens. But when I perform it on HTTPS sites, when I reach the ...
0
votes
1answer
29 views

Question about Standard Access Control List

According to my textbook, it states that a Standard ACL should be placed on the router interface as close to the destination as possible. I am not sure what that means unless each router gets their ...
0
votes
0answers
55 views

How to create reverse shell using teensy as a USB Keyboard?

For pentesting, I found several tutorials and demo codes online. Teensy is a PCB board which can act as Keyboard/Mouse/Joystick. Teensyterpreter I have read tutorials from Teensyterpreter. It is ...
0
votes
1answer
78 views

Detecting DNS tunneling

I have been trying to detect/establish DNS tunneling. First of all I logged out of my user account of the captive portal. Findings: $ nslookup <somesite> // works fine $ ping <somesite> /...
0
votes
2answers
125 views

How to deal with UDP bandwidth exhaustion DDoS attacks?

I am building a service, which will use UDP. It will run on Amazon AWS - in the firewall they provide, I can block everything except that one UDP port my service will run. The only thing I'm ...
0
votes
0answers
44 views

How does an attacker compromise a soft switch?

Speaking of soft switches (e.g soft switch in data plane of software defined networking). I've been trying to find a good research paper or article that explains how an attacker can compromise a soft ...
0
votes
0answers
41 views

ipaddress of my VM doesn't look correct [migrated]

I am trying to setup metasploitable in a Virtualbox VM. My impression is, that once Virtualbox is set up to work in host-only adapter mode, the VMs should follow the networking settings defined in the ...
3
votes
3answers
93 views

Single web application - security advantages to two server model?

I'm looking to deploy infrastructure for a web application that will live on a LAMP stack. The infrastructure is such that this is the only application that will ever live on this server and it must ...
2
votes
1answer
212 views

How to configure Kismet to redetect same BSSIDs in a loop?

So I am working on a tool to detect any wifi device using Kismet. When I use Kismet, it works fine, but my problem is, it detects a device once, and until the MAC changes, it wont detect it again. ...
2
votes
2answers
8k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
95
votes
12answers
19k views

Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)

I just got a new job at a medium-sized (~100 employees) company and one of the first things I was told is that I cannot use my own computer, because I need to be able to connect to their network, ...
3
votes
1answer
120 views

Secure sharing between Windows computers

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD group)...
-4
votes
1answer
42 views

Public IP from my UVerse router [closed]

Please keep in mind that I don't know much so use small words and talk slowly when helping me out. At work we have our network set up in the following way: Our internet comes from AT&T U-verse ...
0
votes
0answers
95 views

VPN Server Inside VPN client on Router

This is a different context of an already asked question: In a few words: Sub-VPN or VPN SubNetwork... VPNsception? So I am using DD-WRT flashed router which connects as a client to VPN server "...
5
votes
1answer
412 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
1
vote
2answers
248 views

Nmap says host down when host is up

I am using nmap 7.12 on Mac OS X. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP replies and vice versa. I am scanning an IP inside the ...
0
votes
0answers
38 views

Setting specific geoIP in Piratebrowser

I'm using Piratebrowser. In order to set a specific country's IP, I used the line ExitNodes {in} which is working. I'm getting an Indian IP in dnsleaktest, but my geolocation is getting a Japanese ...
5
votes
1answer
213 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
10
votes
4answers
583 views

How to design a home network for IoT devices?

I'm trying to work out how best to design a home network which contains (potentially hostile) devices. I'm running into my limits of networking knowledge! I have two challenges. Unsecure Devices ...
0
votes
0answers
53 views

ARP spoofing on WLAN: seeing only traffic coming back

I am attempting to capture network traffic of my mobile device connected to switched network via WIFI, utilizing arpspoof. I did all steps tutorials mention. What I see in Wireshark is only a half ...