Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

18
votes
5answers
3k views

To firewall or not to firewall?

There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
18
votes
4answers
2k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
18
votes
1answer
24k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
17
votes
6answers
2k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
16
votes
2answers
1k views

Hosting an “IP Rental” address. Is this common, safe?

I have a supposed opportunity to get in with an individual with advertising and a side business of his, renting IP addresses. He has asked me to set a dedicated DSL account at my house. Is there any ...
16
votes
6answers
5k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
16
votes
4answers
2k views

Threat assesment for a captive portal

I am interested in setting up a captive portal on a wireless network. From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
16
votes
2answers
1k views

In what scenarios is relying on source IP address as a security control acceptable/unacceptable?

I've noticed that there's a number of questions where relying on source IP address as a control gets mentioned and in most gets dismissed as being unreliable. I'd be interested in hearing from anyone ...
16
votes
3answers
1k views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
15
votes
4answers
16k views

How are spoofed packets detected?

My assumption: When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
15
votes
5answers
21k views

DHCP vs. Static IP Addressing

How do DHCP and Static IP addressing compare, from a security standpoint? What are the risks/benefits associated with each? I know the preferred solution between the two will vary with network size ...
15
votes
2answers
5k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
15
votes
2answers
839 views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
15
votes
3answers
4k views

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
14
votes
3answers
3k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
14
votes
5answers
3k views

Are consumer-grade routers any more or less vulnerable? [closed]

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
14
votes
6answers
2k views

Defamatory post - obtaining evidence tracing perpetrator right to his laptop

A month ago, someone posted an ad with my personal details, including my home address, my phone number and my photo on an ad with very a very defamatory write up. What followed was a week of calls ...
14
votes
5answers
15k views

What is the best practice for placing DataBase servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
14
votes
3answers
1k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
14
votes
5answers
3k views

Can I avoid DNS spoofing by typing the IP address?

The question is in the title. I have been reading about DNS spoofing. What if I were to save the IP addresses of websites I consider sensitive and then just enter the IP address when I am using a ...
14
votes
2answers
560 views

Why on earth would anyone use the 'top secret' option of IPv4?

So, I was reading RFC 791, and got to the bit about options (here). Everything seemed to be decent and sensible, until I got to the 'levels of security' part. Now, I can understand how, internally, ...
14
votes
3answers
2k views

VPS security best practice

I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it. I've previously been hosting it off a VM in the house, but I want to ...
14
votes
1answer
721 views

Are there any security problems with Google false start for TLS?

Google recently announced false start in Chrome browsers which increased TLS performance by 30% http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml I know TLS has been poked ...
14
votes
1answer
3k views

Is it even possible to hack a television channel?

In spite of all the hacking news in the recent few years I never heard of someone who managed to hack a TV channel. What makes them so secure?
13
votes
5answers
3k views

Access to a router's GUI

During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router. I realise that someone could log on and be annoying to ...
13
votes
3answers
4k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
13
votes
5answers
18k views

Why is WPA Enterprise more secure than WPA2?

In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
13
votes
8answers
7k views

Why is ARP poisoning killing all network activity?

Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my ...
13
votes
1answer
5k views

SFTP, FTPS and SecureFTP differences and security implications

What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
13
votes
2answers
8k views

How do Intrusion Detection Systems (IDS) work?

How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?
13
votes
2answers
1k views

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the ...
13
votes
3answers
2k views

Is a predictable MAC address a risk?

If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
13
votes
1answer
6k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
13
votes
3answers
989 views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
12
votes
8answers
1k views

Randomizing MAC addresses on bootup

Since it is possible to set custom MAC addresses, wouldn't it make sense to have a new one as often as possible/convenient (i.e. on bootup)? It would seem that is useful to both attacker and victim ...
12
votes
7answers
517 views

UNIX Servers: Possible intrusions or attacks that do not use any of the open listen sockets

What type of attacks are there that do not use open TCP or open UDP ports? Is it safe to assume that no open ports means no remote access? (Excluding the possibility that there is a badware already ...
12
votes
3answers
14k views

How can I detect if someone is sniffing network packets on the LAN?

I would like to know if there is a product or software that can detect if there is a sniffer currently on the network? In other words is it possible at all to detect if there is a network card on ...
12
votes
2answers
5k views

Can an attacker sniff Mac addresses on a wifi?

If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
12
votes
5answers
548 views

How can citizens prevent government-led Internet blackouts?

The United Nations now considers Internet access a basic human right. [PDF] Despite the questionable effectiveness of Internet blackouts in silencing a populace and preventing uprisings1, it's ...
12
votes
4answers
7k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
12
votes
1answer
784 views

XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?

In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
12
votes
3answers
404 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
12
votes
3answers
901 views

Are there valid reasons for spoofing an address?

This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?. Are there valid reasons to spoof an address?
12
votes
2answers
3k views

Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?

I have read the TCP Connection Establishment on Wikipedia In brief the packets to start are SYN, with a (hopefully) random sequence number A from the client. SYN-ACK, responding, with A+1 and ...
12
votes
3answers
13k views

How do I ensure data encryption on Samba transmission on *NIX systems?

I have a heterogeneous system (both MS and *nix) that communicates with CIFS/SMB. How can I ensure proper data encryption at the application layer?
12
votes
4answers
794 views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
12
votes
2answers
2k views

How are mobile telephony networks like LTE and HSPA encrypted?

How are mobile telephony networks like LTE (4G) and HSPA (3G) encrypted? between what parts is the communication encrypted? who has access to the keys? is symmetric or asymmetric encryption used? is ...
11
votes
4answers
3k views

How to prevent network administrators from accessing USB drive

How can I prevent network administrators from accessing, mapping to etc. a USB drive that's in a PC on their network? I'm mainly concerned about files being edited or deleted.
11
votes
6answers
4k views

How can mini-computers (like Raspberry Pi) be applied to IT security?

It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
11
votes
7answers
3k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...