Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

10
votes
5answers
2k views

Can voice chat be spied?

I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but ...
9
votes
2answers
10k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
42
votes
1answer
2k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
9
votes
6answers
10k views

Automated tools for Cisco IOS config auditing? [closed]

Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.
6
votes
2answers
4k views

Need help identifying the OSX process that's generating strange network traffic

Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like: Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
6
votes
2answers
6k views

Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?

We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related ...
5
votes
1answer
826 views

What are the vulnerabilities of VOIP-specific security protocols?

Existing relevant questions: How do you Secure VOIP in a large organization What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet? Do secure phone ...
5
votes
3answers
6k views

How do you detect load balancing?

Scenario You need to PenTest XYZ.com. You expect, because it is a high traffic site, that multiple servers are being used with a load balancer. Question Aside from pulling the MACs (which are ...
11
votes
1answer
4k views

Is WPA2 WiFi protected against ARP poisoning and sniffing?

Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?
9
votes
5answers
7k views

Can I block based on Mac Address?

Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ? I want to block at the Webserver level so that unwanted users ...
5
votes
5answers
5k views

What kind of attacks against home router's NAT do exist?

I always thought NAT was some kind of a security feature and I still think it is, because if it didn't existed the internet, respectively the clients behind NATs, would be even more insecure, since ...
11
votes
2answers
3k views

Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?

I have read the TCP Connection Establishment on Wikipedia In brief the packets to start are SYN, with a (hopefully) random sequence number A from the client. SYN-ACK, responding, with A+1 and ...
10
votes
4answers
2k views

Why don't ISPs filter on source address to prevent spoofing?

I'm under the impression that if all the ISP's were required to filter on the source IP address of all outbound packets, that spoofing would be reduced considerably. Are any ISPs implementing this ...
7
votes
3answers
680 views

Is IPv6 with NAT less secure than IPv4?

This is a follow up to a snippet from another answer. There, user Ninefingers writes: (...) only allow outbound connections, ever. Do this in spite of NAT as IPv6 will make those NAT defences ...
7
votes
1answer
832 views

How to get hold of and use WPA session keys?

I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I ...
6
votes
2answers
2k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
6
votes
3answers
3k views

Advantages of separating Web server from Database

What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
4
votes
4answers
1k views

Is it possible to catch a virus on my LAN without clicking on anything?

My unpatched PC running Windows is connected to a network which contains other "infected" computers, can I get infected by viruses without any interaction on my part?
3
votes
1answer
143 views

Securing my network: unmasking spoofed mac possible?

In Kali you can: airmon-ng start wlan0 ifconfig mon0 down macchanger -r mon0 (-r changes mac id to a random number) ifconfig mon0 up This attack for example: aireplay-ng -0 2 -a [ap mac #] -c ...
2
votes
6answers
40k views

How to bypass restrictive mac address filtering on home network (not malicious)

Background A short sketch of my situation before I formulate my question: I am on a large home network, which is privately administered by a couple of admins. The network consists of a lan and a ...
1
vote
3answers
4k views

Is there any solution for block the HTTPS traffic using URL filtering?

The URL filtering can block the HTTP traffic but not the HTTPS traffic in Internet Explorer. For example, the website http://www.facebook.com is blocked by the URL filtering while the ...
-2
votes
4answers
11k views

If a hacker is on the same Wifi Network as I am, what can he do? [duplicate]

Ok so when a hacker has the wifi network's password and gets on the network, he can do things like monitor traffic, catch passwords, even access PCs, etc. But what I'm interested of knowing is what ...
12
votes
3answers
807 views

Are there valid reasons for spoofing an address?

This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?. Are there valid reasons to spoof an address?
4
votes
2answers
2k views

What is more secure: ISDN, Cable Modem, DSL, T1, etc…?

This discussion came after showing a friend this Security.SE post regarding DNS attacks, and after reading about a Cable Modem MITM attack. Given the current options available to consumers, what ...
1
vote
3answers
1k views

How can alleged illegal downloading be detected?

Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method? Update Using a honey pot or monitoring the peers list makes ...
-1
votes
3answers
247 views

Can workplace wifi track ip address to an employee's computer? [duplicate]

At my work there is secure WiFi for all the employees. If someone has sent harrassment / sexual harrassment emails to me through the company WiFi, is there a way for my company to trace the IP address ...
20
votes
1answer
5k views

What are darknets, and how can they be used to provide security and anonymity in network communication?

One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
18
votes
5answers
17k views

Can I detect a MITM attack?

Based on this question here: Are "man in the middle" attacks extremely rare? Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it? In addition, what if ...
29
votes
10answers
25k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
23
votes
2answers
68k views

What is the real function and use of a DMZ on a network?

I read the article on Wikipedia describing what a DMZ (demilitarized zone) is on a network, but am still failing to grasp both how it is set up (ie: is it within the main network or sequestered away?) ...
15
votes
3answers
4k views

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
13
votes
3answers
2k views

VPS security best practice

I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it. I've previously been hosting it off a VM in the house, but I want to ...
11
votes
4answers
3k views

How to prevent network administrators from accessing USB drive

How can I prevent network administrators from accessing, mapping to etc. a USB drive that's in a PC on their network? I'm mainly concerned about files being edited or deleted.
13
votes
2answers
8k views

How do Intrusion Detection Systems (IDS) work?

How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?
11
votes
4answers
319 views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
8
votes
1answer
667 views

What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?

What are the main issues and recommended controls when exposing SIP and H.323 to the Internet (could be for voice, video, and instant messaging traffic or all three)? Specifically I'm looking for ...
8
votes
4answers
6k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
6
votes
2answers
3k views

What is the difference between SSH and IPsec?

There seems to be similar encryption going into both. They both use asymmetric (RSA, elliptic curves, etc) for the initial key exchange, then go to some symmetric (AES, Blowfish, etc) protocol. I'm ...
4
votes
6answers
12k views

monitoring outgoing network traffic

The graphs for one server that I am using are showing consistent 7.5 kb/s outgoing network traffic that started a few days ago. How can I monitor/log/capture/analize this traffic to see what is it, ...
3
votes
2answers
4k views

Using Cain and Abel to capture traffic of machine in the same network

I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
18
votes
4answers
2k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
15
votes
2answers
709 views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
15
votes
4answers
2k views

Threat assesment for a captive portal

I am interested in setting up a captive portal on a wireless network. From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
12
votes
3answers
12k views

How do I ensure data encryption on Samba transmission on *NIX systems?

I have a heterogeneous system (both MS and *nix) that communicates with CIFS/SMB. How can I ensure proper data encryption at the application layer?
9
votes
1answer
407 views

Kaspersky Antivirus “secure connection scan” as broken as Superfish?

I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky ...
9
votes
2answers
1k views

Malware known to use port knocking to evade detection by network scanners?

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
8
votes
6answers
2k views

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ...
4
votes
3answers
1k views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
4
votes
2answers
2k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
14
votes
3answers
944 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?