Network Security - securing network infrastructure and connections
4
votes
2answers
855 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
19
votes
5answers
9k views
Is it still unsafe to email credit card number nowadays?
We all know not to do it, but someone emailed my credit card number and cvv code to my gmail.
I'm wondering if the risk is so low I don't have to call to cancel my card.
The email is sent from a ...
11
votes
3answers
249 views
Verifying server software integrity?
I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
10
votes
1answer
2k views
Is WPA2 WiFi protected against ARP poisoning and sniffing?
Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?
7
votes
6answers
664 views
How can I restrict access to network data by an unauthorized computer that connects via Ethernet?
I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers.
However what if a computer is connected via Ethernet and does not ...
3
votes
2answers
1k views
Using Cain and Abel to capture traffic of machine in the same network
I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
12
votes
4answers
874 views
Threat assesment for a captive portal
I am interested in setting up a captive portal on a wireless network.
From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
8
votes
2answers
2k views
Can an attacker sniff Mac addresses on a wifi?
If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
7
votes
3answers
333 views
Is IPv6 with NAT less secure than IPv4?
This is a follow up to a snippet from another answer.
There, user Ninefingers writes:
(...) only allow outbound connections, ever. Do this in spite of NAT as IPv6 will make those NAT defences ...
7
votes
1answer
1k views
Bypassing hidden SSID and MAC filtering “protection”
I was browsing over this question and had some follow up questions from a practical perspective.
What tools will show the SSID of an AP with the SSID set to hidden or broadcasting disabled? I have ...
7
votes
2answers
586 views
Malware known to use port knocking to evade detection by network scanners?
Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
6
votes
1answer
883 views
Security Operation Center (SOC)
I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
2
votes
1answer
242 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
2
votes
2answers
388 views
how to identify p2p on network
Im trying to work out if the traffic in the below image is P2P file sharing?
If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
15
votes
3answers
614 views
What are the risks of using a CDN to speed up my website? How do I avoid them?
Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN.
What ...
10
votes
7answers
1k views
Egress filtering on an office network?
With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
8
votes
4answers
2k views
Looking for botnet IP address feeds to protect against DDoS
I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
8
votes
4answers
1k views
Is NTP vulnerable to DNS poisoning or spoofing attacks?
Scenario:
Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application)
Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...
7
votes
3answers
421 views
Secure PXE network OS installation
How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)?
Would it be possible to ...
7
votes
6answers
214 views
Why shouldn't I run other applications on a Firewall?
If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)?
The only opened port to the world (wan ...
7
votes
4answers
392 views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks
Is the presence of wireless access points tested for by using a wireless analyzer at ...
7
votes
3answers
339 views
Popularity of Anomaly based IDSes
I've been reading quite some time about anomaly/behavior based IDSes for Web servers.
I understand the downsides: possible high false positives, learning phase, constant training.
My question is how ...
5
votes
2answers
303 views
How can I use nmap to distinguish between a normal linux machine and an android device?
According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
5
votes
2answers
577 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
5
votes
1answer
3k views
Are open ports dangerous?
I have forwarded port 80 to WAMPServer and 25565 to the MineCraft-server running Bukkit. (http://www.bukkit.org/)
Am I vulnerable to attacks. Can hackers attack me if WAMP-server is running or if it ...
5
votes
5answers
377 views
Is there a way to identify the host of a malicious VM from across the network?
Scenario:
Someone is attacking your network. However, they're not exactly using their machine to do it - they're using a VM running on their system. The VM's network adapter is configured in ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
4
votes
3answers
651 views
Opensource NetFlow generator
Cisco routers are able to generate NetFlow flows that can be captured and then analyzed in order to manage what is going on on your network. Unfortunately, I don't have a Cisco router in my toolbox so ...
4
votes
1answer
736 views
Is indirect access to a computer as bad as direct?
I'm deploying a web-based ERP system for a customer, such that both the server and the client machines will be inside the customer's intranet. I was advised not to allow the server machine to connect ...
4
votes
2answers
945 views
incoming packets in server
I have enabled iptables logging for packets coming from the outside
-A INPUT ! -s 192.168.218.0/24 -j LOG
Now i am seeing lots of incoming packets from unknown addresses
Jun 5 14:54:56 localhost ...
3
votes
2answers
2k views
Router admin password was changed, how did this happen and how to prevent [closed]
Internet was extremely spotty for about a week. I was on/off cycling the cable model and router almost daily, before I tried to sign into my router (198.162.1.1). When I did I was presented with a ...
3
votes
4answers
3k views
What are the laws regarding ISP recording IP addresses? How would they know who had which?
Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
3
votes
2answers
311 views
1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab
I bought a bunch of cisco equipment for a project and I got
1 PIX firewall
2 switches
and 2 routers
This is my plan for a topology but I am new at this so I need help.
I am basing this off the ...
3
votes
2answers
735 views
What is more secure: ISDN, Cable Modem, DSL, T1, etc…?
This discussion came after showing a friend this Security.SE post regarding DNS attacks, and after reading about a Cable Modem MITM attack.
Given the current options available to consumers, what ...
3
votes
4answers
189 views
What does a switched network protect us from? What does it not protect us from?
There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
2
votes
5answers
545 views
Building my own Darkspace
I have searched through the internet about creating a darknet and there is a confusion.
There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
2
votes
3answers
205 views
Identify a process that uploads data
I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
2
votes
4answers
214 views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
2
votes
1answer
2k views
What are SSDP notify requests and where can I find out exactly what this traffic is?
What is a SSDP protocol request with notify http/1.1 ? How can I find out what this network traffic is?
2
votes
2answers
157 views
Which private-key encryption should I use for server to server communication?
I am tempted to write my own which covers:
Checksum to ensure data is not tampered with.
Long and multiple rotating keys so that it is (practically) impossible to decrypt.
Will use /dev/random for ...
2
votes
2answers
769 views
Is it possible to change the admin user/password remotely on a router without logging in?
Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
2
votes
2answers
773 views
How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?
I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information.
Can someone elaborate on what happens when an update is made, and how it is ...
1
vote
3answers
395 views
How can alleged illegal downloading be detected?
Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method?
Update
Using a honey pot or monitoring the peers list makes ...
1
vote
1answer
122 views
Maximum protection on a computer network?
I would like to secure as much as possible a computer I am using to sync sensitive data files from work to my home pc. The syncronisation is being done by only 1 software is there a firewall to allow ...
1
vote
1answer
144 views
Can accounts still be logged onto if Password Caching is not enabled?
This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
0
votes
1answer
226 views
Is using a local DNS cache server more secure than using a DNS server from a router?
Is using a local DNS cache server imore secure than using a DNS server from a router?
-2
votes
0answers
83 views
History of RAT + Strange networking recently… was I hacked again? [closed]
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
