Network Security - securing network infrastructure and connections
2
votes
2answers
96 views
Does “loose source and record route” drop the source address?
Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur?
It ...
12
votes
1answer
390 views
Why on earth would anyone use the 'top secret' option of IPv4?
So, I was reading RFC 791, and got to the bit about options (here). Everything seemed to be decent and sensible, until I got to the 'levels of security' part.
Now, I can understand how, internally, ...
5
votes
3answers
459 views
Security measures for a WiFi access point?
I am planning to purchase a program that comes with an App that allows you to control the program via phone. The developer told me that the connection will be done via an extra WIFI box connecting to ...
2
votes
5answers
184 views
How to bypass Nmap blockage?
I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside?
Also, does blocking nmap on a network provide any security?
...
6
votes
4answers
309 views
Has my network/computer been breached?
I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes.
A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
2
votes
2answers
170 views
do different subnet masks on home network provide any security?
So I have two routers on my home network: one is provided by my ISP, and the other is my private router.
Router A- ISP router: 192.168.1.x
router B- private router: 192.168.2.x
Clients on my ...
1
vote
2answers
102 views
Intrusion Prevention Systems: NIPS vs NBA
I was going through the wikipedia article on Intrusion Prevention Systems.
It states two of the four types of IPS as follows:
Network-based intrusion prevention system (NIPS): monitors the entire ...
3
votes
3answers
233 views
How will IPv6 affect DDoS mitigation techniques?
IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks. What are some examples of risks and mitigations?
For example, ...
1
vote
1answer
127 views
Exchange of DEK and KEK (encryption keys) between app server and key server
In my application, it is required to encrypt a user's data before inserting it into the mysql database. I am using AES algorithm to encrypt the data using a 256 bit hash (and is calling it Data ...
3
votes
2answers
215 views
Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
I understand that there are many applications such as Snort that do the job for network layer 3 IDS.
From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
-1
votes
1answer
124 views
Can File Sharing being Controlled by Mac Address? [closed]
I am currently setting up secure environment between 2 pc in isolated network.
Just wondering can we do file sharing based on that pc mac address instead of username?
The environment is OEM Windows ...
3
votes
1answer
225 views
Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?
I'm trying to develop an IDS/IPS system project to include these elements:
A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1)
A Linux server (Running Kismet server + client)
...
1
vote
1answer
148 views
Tor traffic seems to be exiting from different Tor exit nodes - is that expected?
I seem to be observing some odd behaviour whilst experimenting with TOR. It's entirely possible this is just my own ignorance as well, in which case I would appreciate some ...
5
votes
1answer
253 views
Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice
I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
5
votes
2answers
205 views
How did Evernote detect the security breach?
http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
Evernote's official message says little about technical details of the attack and how it was detected.
...
6
votes
2answers
201 views
Segmenting Virtual Network Traffic
I have a basic to moderate understanding of VLAN's and their pros and cons as they relate to network segmentation but I'm wondering where to start as one moves into virtualized environments.
From a ...
2
votes
1answer
156 views
Tacacs+ scenario: can I permit user to configure only for one interface and deny others
I'm currently deploying TACACS+ with a Cisco device, I use a TACACS server from here: http://www.shrubbery.net/tac_plus/
My scenario is: I want to permit a user to configure my router but only for a ...
10
votes
4answers
4k views
How are spoofed packets detected?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
0
votes
4answers
158 views
How does one go about network forensics investigation with no prior knowledge?
I am being asked to perform a forensics investigation on a network.
The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration ...
1
vote
0answers
70 views
Which are appropiate tests to perform during an internal/LAN security audit? [closed]
In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.)
Which are ...
0
votes
1answer
75 views
All I see is RPC, how do I proceed?
I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise.
The machine was only running ...
3
votes
1answer
132 views
Is RDP an effective security barrier
If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
1
vote
2answers
80 views
non-periodic event detection
I'm searching for keylogger detection. As far as I see, almost all of keyloggers created by tools are sending data to a host periodically, but the ones made by coders may send data non-periodically. ...
1
vote
1answer
46 views
Does pppd encrypt traffic?
There is pppd program that can be used to create point-to-point conections over various channels (including other network).
It supports authentication and compression. But does it encrypt traffic or ...
0
votes
1answer
57 views
MACSEC nonce/key uniqueness
802.1ae requires a nonce to be sent with each Ethernet frame in the MACSEC tag. The 96 bit nonce is formed by concatenating a 64 bit fixed field (based on MAC source address and port number) with a ...
3
votes
5answers
121 views
How to introduce delay in scanning tools that do not implement delay without touching source code?
Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.
Is there a way to delay packets from ...
4
votes
3answers
360 views
How do you detect load balancing?
Scenario
You need to PenTest XYZ.com.
You expect, because it is a high traffic site, that multiple servers are being used with a load balancer.
Question
Aside from pulling the MACs (which are ...
0
votes
1answer
111 views
Packet-filtering firewall evasion (Scanning)
Context
I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
0
votes
1answer
80 views
A list of very specific infosec topics with very fine detail [closed]
CISSP CBK seems relatively rudimentary and extremely broad.
Does anyone know a good resource that lists (a nice, long list) topics in information security with a very, very fine granularity?
This:
- ...
2
votes
2answers
268 views
What is more risky? Database Server in DMZ or Trusted Network?
Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.
Assume the following
A web server is being used for ...
2
votes
2answers
379 views
Protecting against SSL Strip [duplicate]
I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe?
Does it depend on the cert strength?
Do you ...
2
votes
2answers
222 views
keylogger detection by listening network
It is known that malware often uses keyloggers. Also some viruses aren't detected by antiviruses, therefore some viruses, especially APTs could stay in a system for so long without any detection. What ...
1
vote
1answer
113 views
What are the basic implementations that make a network secure from the inside\outside?
Would you consider the following to be "basic hardening items" for network equipment and servers?
VLANs
Access Control (such as NTFS permissions)
Patch Management System
Host Firewall
Anti-Virus
...
6
votes
3answers
363 views
Should SSL be terminated at a load balancer?
When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
4
votes
6answers
6k views
If someone hacks my wi-fi connnection, what can they see and how?
I have two questions on wifi security:
If someone knows my wifi password (be it WEP or WPA) what can they
see on my screen? Do they just see URLs I visit, or can they see
everything in my ...
2
votes
3answers
667 views
How to tell if you're being ARP poisoned?
I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios:
Over WiFi bridge pluged into cisco router to took ...
5
votes
1answer
74 views
Are temporary blocks sufficient response to network probes?
We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time.
...
14
votes
1answer
993 views
Why can you bypass restricted WiFis by adding “?.jpg” to the URL?
I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
1
vote
2answers
147 views
What type of data does Snort log?
This is new to me, but what types of data does Snort log for Network Intrusion Detection?
I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
5
votes
2answers
1k views
Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?
is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks.
If it can, how, but if not, is there another ...
1
vote
2answers
119 views
Wifi box produces three SSIDs?
While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
-1
votes
5answers
180 views
How can I configure my router to prevent connections bypassing it?
I am trying to configure my router to control access for several of my devices at home.
I am currently using a linksys router.
Our home consists of three devices (a desktop, a laptop, and a ...
0
votes
1answer
151 views
Rootkits, how much should I be concerned? I found a suspicious activity on my network
In the old age netstat was one of my favorite tools to check out possible malicious connection, but then I took note about the dangerous of incoming rootkits and its high complexity, being able to ...
10
votes
1answer
1k views
What are darknets, and how can they be used to provide security and anonymity in network communication?
One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
-1
votes
1answer
36 views
netflow capture of one subnet only? [closed]
is it possible to capture only one subnet of netflow traffic?
For instance: If a switch processes traffic of the subnet 10.1.x.x and 10.2.x.x, would it be possible to capture only traffic of 10.2.x.x ...
2
votes
5answers
545 views
Building my own Darkspace
I have searched through the internet about creating a darknet and there is a confusion.
There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
2
votes
2answers
155 views
Analyzing Network Anomalies for Malicious events
For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main ...
0
votes
1answer
178 views
DrayTek Vigor 2920 HTTPS allowed
In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups.
This all works fine, however we've discovered that all HTTPS ...
-1
votes
1answer
169 views
IPSec VPN v/s MPLS VPN in cellular v/s public internet access [closed]
Looking to understand the options available in WAN machine to machine communication. Cellular providers provide MPLS based VPN. IPSec VPN is another option available over the public internet.
What ...
10
votes
4answers
621 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
