Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

23
votes
4answers
7k views

Are popular porn sites more likely to be infected with malware?

I'm trying to help my friend understand this because he believes that since a site is very popular, that it's less likely to infect its viewers because of its security! Is a popular site less likely ...
23
votes
1answer
6k views

What are darknets, and how can they be used to provide security and anonymity in network communication?

One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
22
votes
8answers
4k views

Is possible to get infected by only staying connected to the Internet (nothing else)?

I have a router and I'm the only user. I have a computer with Linux and a tablet with Windows 8.1. Because of a few problems, I had to reinstall Windows on the tablet. Since I'm a bit paranoid about ...
21
votes
12answers
47k views

Public DMZ network architecture

Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one: Now that I got employed, my boss, a ...
21
votes
1answer
30k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
20
votes
5answers
27k views

How to find out that a NIC is in promiscuous mode on a LAN?

How to find out that a NIC is in promiscuous mode on a LAN?
20
votes
5answers
3k views

419 Nigerian scam problem

I fell in a scamming trap. It took me a while to figure it out. Blinded like an idiot. But it is what it is. I can only do as much as I can now. Tell me if there is anything else I should do. After ...
20
votes
4answers
2k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
19
votes
6answers
3k views

What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receive ...
19
votes
4answers
2k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
19
votes
5answers
10k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
19
votes
5answers
3k views

To firewall or not to firewall?

There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. ...
19
votes
2answers
1k views

In what scenarios is relying on source IP address as a security control acceptable/unacceptable?

A number of questions on this site mention relying on source IP address as a control and in most of them it is dismissed as being unreliable. In what circumstances might using source IP address as a ...
19
votes
3answers
4k views

What are the risks of using a CDN to speed up my website? How do I avoid them?

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
18
votes
4answers
20k views

How are spoofed packets detected?

My assumption: When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops ...
18
votes
3answers
2k views

Are open wireless networks unencrypted?

When you connect to an open wireless network (that is, a wireless network without any symmetric password set) is there any sort of secure key exchange going on, or is data sent back and forth ...
18
votes
4answers
3k views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reached the ...
18
votes
4answers
14k views

Can home routers get infected?

I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection? I used the search bar but ...
18
votes
2answers
6k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
17
votes
6answers
6k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
17
votes
5answers
28k views

Why is WPA Enterprise more secure than WPA2?

In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
17
votes
3answers
6k views

Can an attacker sniff Mac addresses on a wifi?

If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
17
votes
2answers
759 views

Why on earth would anyone use the 'top secret' option of IPv4?

So, I was reading RFC 791, and got to the bit about options (here). Everything seemed to be decent and sensible, until I got to the 'levels of security' part. Now, I can understand how, internally, ...
17
votes
1answer
5k views

Is it even possible to hack a television channel?

In spite of all the hacking news in the recent few years I never heard of someone who managed to hack a TV channel. What makes them so secure?
16
votes
2answers
1k views

Hosting an “IP Rental” address. Is this common, safe?

I have a supposed opportunity to get in with an individual with advertising and a side business of his, renting IP addresses. He has asked me to set a dedicated DSL account at my house. Is there any ...
16
votes
4answers
24k views

DHCP vs. Static IP Addressing

How do DHCP and Static IP addressing compare, from a security standpoint? What are the risks/benefits associated with each? I know the preferred solution between the two will vary with network size ...
16
votes
3answers
5k views

Running windows in virtual machine, should I bother with security?

I'm running Windows in a virtual machine on my mac (via Parallels). Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)? I ...
16
votes
1answer
5k views

SFTP, FTPS and SecureFTP differences and security implications

What are the basic differences and security implications of using SFTP, FTPS and SecureFTP.
16
votes
4answers
2k views

Threat assesment for a captive portal

I am interested in setting up a captive portal on a wireless network. From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
16
votes
1answer
1k views

Do any DNS registrars support multi factor authentication?

I am looking for a DNS registrar that supports strong multi-factor authentication. Does any DNS registrar support multi-factor? Is this a legitimate need?
16
votes
3answers
1k views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
15
votes
5answers
3k views

Are consumer-grade routers any more or less vulnerable? [closed]

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
15
votes
5answers
20k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
15
votes
8answers
10k views

Why is ARP poisoning killing all network activity?

Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my ...
15
votes
3answers
19k views

with IPv6 do we need to use NAT any more ?

I'm wondering how to use NAT with IPv6 ...seems that you don't even need it any more. So what exactly is the concept behind firewall configurations in IPv6 environments?
15
votes
1answer
924 views

XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?

In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
15
votes
2answers
1k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
15
votes
3answers
5k views

Recommendations for honeypot software

A couple of us wanted to setup a honeypot/honeynet with the goal of learning; not planned to be in a production environment. What's a good recommendation for a high interaction or low interaction ...
14
votes
3answers
4k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
14
votes
5answers
3k views

Access to a router's GUI

During a recent visit to a coffee shop, I noticed that they hadn't bothered changing their default user name and password for their router. I realise that someone could log on and be annoying to ...
14
votes
3answers
5k views

Nessus vs third-party scans

As part of our PCI-DSS compliance process we get scans done by a third party. Based on the form and wording of the output, it's pretty clear they're using Nessus for most of their heavy lifting. Same ...
14
votes
3answers
28k views

How does “traceroute over TCP” work, what are the risks, and how can it be mitigated?

There is a utility called tcptraceroute, and this enhancement called intrace that is used just like a standard traceroute, but it works over TCP. How is the syn flag in TCP used to achieve ...
14
votes
6answers
2k views

Defamatory post - obtaining evidence tracing perpetrator right to his laptop

A month ago, someone posted an ad with my personal details, including my home address, my phone number and my photo on an ad with very a very defamatory write up. What followed was a week of calls ...
14
votes
5answers
3k views

Can I avoid DNS spoofing by typing the IP address?

The question is in the title. I have been reading about DNS spoofing. What if I were to save the IP addresses of websites I consider sensitive and then just enter the IP address when I am using a ...
14
votes
2answers
2k views

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the ...
14
votes
2answers
11k views

How do Intrusion Detection Systems (IDS) work?

How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?
14
votes
3answers
2k views

VPS security best practice

I've just signed up for a linux VPS to host a website I've been creating and I need some advice on the best approach to secure it. I've previously been hosting it off a VM in the house, but I want to ...
14
votes
1answer
786 views

Are there any security problems with Google false start for TLS?

Google recently announced false start in Chrome browsers which increased TLS performance by 30% http://news.softpedia.com/news/Google-Chrome-s-SSL-False-Start-201253.shtml I know TLS has been poked ...
14
votes
1answer
7k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
14
votes
3answers
18k views

How do I ensure data encryption on Samba transmission on *NIX systems?

I have a heterogeneous system (both MS and *nix) that communicates with CIFS/SMB. How can I ensure proper data encryption at the application layer?