Network Security - securing network infrastructure and connections
1
vote
0answers
71 views
Which are appropiate tests to perform during an internal/LAN security audit? [closed]
In the internal network we know that controls are less strict than externally but in the other hand we know that lots of attacks come from the internal segment (unhappy workers, etc.)
Which are ...
0
votes
1answer
79 views
All I see is RPC, how do I proceed?
I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise.
The machine was only running ...
1
vote
4answers
294 views
How password hashing is useful in MITM attack?
Even though I read a lot about hashing and how passwords are protected, I am still confused about it.
If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
2
votes
7answers
472 views
Tracking unique web site visits without logging IP addresses
On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it.
On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it.
If the two IP addresses are equal, I throw out the ...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
1
vote
2answers
80 views
non-periodic event detection
I'm searching for keylogger detection. As far as I see, almost all of keyloggers created by tools are sending data to a host periodically, but the ones made by coders may send data non-periodically. ...
2
votes
2answers
386 views
how to identify p2p on network
Im trying to work out if the traffic in the below image is P2P file sharing?
If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
3
votes
1answer
134 views
Is RDP an effective security barrier
If you need to provide access to a GUI / GUIs in one network from within another network, can RDP (e.g. via Terminal Services) be used as an effective security 'barrier', to stop any other direct ...
1
vote
1answer
46 views
Does pppd encrypt traffic?
There is pppd program that can be used to create point-to-point conections over various channels (including other network).
It supports authentication and compression. But does it encrypt traffic or ...
0
votes
1answer
58 views
MACSEC nonce/key uniqueness
802.1ae requires a nonce to be sent with each Ethernet frame in the MACSEC tag. The 96 bit nonce is formed by concatenating a 64 bit fixed field (based on MAC source address and port number) with a ...
3
votes
5answers
121 views
How to introduce delay in scanning tools that do not implement delay without touching source code?
Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.
Is there a way to delay packets from ...
4
votes
3answers
368 views
How do you detect load balancing?
Scenario
You need to PenTest XYZ.com.
You expect, because it is a high traffic site, that multiple servers are being used with a load balancer.
Question
Aside from pulling the MACs (which are ...
0
votes
1answer
112 views
Packet-filtering firewall evasion (Scanning)
Context
I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
0
votes
1answer
82 views
A list of very specific infosec topics with very fine detail [closed]
CISSP CBK seems relatively rudimentary and extremely broad.
Does anyone know a good resource that lists (a nice, long list) topics in information security with a very, very fine granularity?
This:
- ...
1
vote
1answer
113 views
What are the basic implementations that make a network secure from the inside\outside?
Would you consider the following to be "basic hardening items" for network equipment and servers?
VLANs
Access Control (such as NTFS permissions)
Patch Management System
Host Firewall
Anti-Virus
...
2
votes
2answers
284 views
What is more risky? Database Server in DMZ or Trusted Network?
Hoping this is not a dupe of any of the related database / DMZ questions, but I don't think any of them answered my question sufficiently.
Assume the following
A web server is being used for ...
19
votes
5answers
948 views
Is having Steam installed a security risk?
Speaking to one of our security administrators at work, he insists that Steam is a well understood security risk and it shouldn't be installed on work machines.
Saying it's not work related I ...
2
votes
2answers
420 views
Protecting against SSL Strip [duplicate]
I've read you can attack connections using tools like sslstrip, if you are on the same network. So what ensures that our SSL connections remain safe?
Does it depend on the cert strength?
Do you ...
2
votes
2answers
231 views
keylogger detection by listening network
It is known that malware often uses keyloggers. Also some viruses aren't detected by antiviruses, therefore some viruses, especially APTs could stay in a system for so long without any detection. What ...
6
votes
3answers
386 views
Should SSL be terminated at a load balancer?
When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
2
votes
3answers
694 views
How to tell if you're being ARP poisoned?
I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios:
Over WiFi bridge pluged into cisco router to took ...
5
votes
3answers
269 views
Does NAT break source port randomization?
The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.
Does NAT break the security benefits of source port randomization?
In more detail, consider ...
5
votes
1answer
75 views
Are temporary blocks sufficient response to network probes?
We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time.
...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
26
votes
7answers
5k views
Are powerline ethernet adapters inherently secure?
I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
14
votes
1answer
1k views
Why can you bypass restricted WiFis by adding “?.jpg” to the URL?
I recently read an article on Hacking a commercial airport WLAN. It's basically about circumventing paid airport WiFi redirections (they redirect you to a certain URL when you type something in the ...
5
votes
2answers
1k views
Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?
is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks.
If it can, how, but if not, is there another ...
7
votes
3answers
362 views
Would publishing a network diagram make the network less secure?
I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration.
Does sharing this type of information decrease the security of my network?
...
1
vote
2answers
147 views
What type of data does Snort log?
This is new to me, but what types of data does Snort log for Network Intrusion Detection?
I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
1
vote
2answers
120 views
Wifi box produces three SSIDs?
While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
-1
votes
5answers
184 views
How can I configure my router to prevent connections bypassing it?
I am trying to configure my router to control access for several of my devices at home.
I am currently using a linksys router.
Our home consists of three devices (a desktop, a laptop, and a ...
96
votes
8answers
8k views
Are “man in the middle” attacks extremely rare?
In
http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
0
votes
2answers
2k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
0
votes
1answer
151 views
Rootkits, how much should I be concerned? I found a suspicious activity on my network
In the old age netstat was one of my favorite tools to check out possible malicious connection, but then I took note about the dangerous of incoming rootkits and its high complexity, being able to ...
10
votes
1answer
2k views
What are darknets, and how can they be used to provide security and anonymity in network communication?
One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
10
votes
8answers
700 views
Randomizing MAC addresses on bootup
Since it is possible to set custom MAC addresses, wouldn't it make sense to have a new one as often as possible/convenient (i.e. on bootup)?
It would seem that is useful to both attacker and victim ...
2
votes
5answers
545 views
Building my own Darkspace
I have searched through the internet about creating a darknet and there is a confusion.
There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
-1
votes
1answer
178 views
IPSec VPN v/s MPLS VPN in cellular v/s public internet access [closed]
Looking to understand the options available in WAN machine to machine communication. Cellular providers provide MPLS based VPN. IPSec VPN is another option available over the public internet.
What ...
10
votes
2answers
1k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
3
votes
2answers
231 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
4
votes
4answers
9k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
4
votes
4answers
924 views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
1
vote
3answers
1k views
Ignoring broadcasts to 10.0.0.255 using iptables
I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:
$IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP
$IPTABLES -A FORWARD -d 10.0.0.255 -j DROP
It ...
4
votes
4answers
666 views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
2
votes
3answers
218 views
Repudiation in Copyright Infringement (BitTorrent)
Seeing this question : How did an alleged illegal downloading be detected? sparked a question I have had for a long time.
How does repudiation/non-repudiation work in such cases ?
Argument: It is ...
2
votes
1answer
166 views
Are man-in-the-middle attacks against p2p systems realistic?
I'm implementing a DHT based on Kademlia following this paper.
The protocol described in this paper uses nonces to protect against man-in-the-middle attacks. The disadvantage is that latency gets ...
2
votes
1answer
242 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
3
votes
3answers
209 views
Privacy issues in Peer to Peer networks
In any typical P2P file sharing app, say DC++, the typical operations are search content, push content and pull content. A peer node broadcasts/multicasts its query to fellow peers and receives ...
1
vote
6answers
197 views
Secure internet access while traveling
Given the risks of shared wi-fi as stated here, here and here, I would like to ask what are good practices for someone who is always traveling.
While having your own wi-fi with a strong WPA2 password ...
