Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

5
votes
4answers
1k views

Email header IP address

Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?
4
votes
3answers
6k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
3
votes
5answers
1k views

Building my own Darkspace

I have searched through the internet about creating a darknet and there is a confusion. There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
11
votes
2answers
5k views

Can an attacker sniff Mac addresses on a wifi?

If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
11
votes
4answers
6k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
11
votes
7answers
2k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
9
votes
3answers
4k views

Security measures for a WiFi access point?

I am planning to purchase a program that comes with an App that allows you to control the program via phone. The developer told me that the connection will be done via an extra WIFI box connecting to ...
9
votes
3answers
660 views

Would publishing a network diagram make the network less secure?

I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration. Does sharing this type of information decrease the security of my network? ...
9
votes
1answer
2k views

Bypassing hidden SSID and MAC filtering “protection”

I was browsing over this question and had some follow up questions from a practical perspective. What tools will show the SSID of an AP with the SSID set to hidden or broadcasting disabled? I have ...
8
votes
1answer
678 views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
8
votes
4answers
4k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
8
votes
2answers
455 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
6
votes
2answers
4k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
5
votes
5answers
336 views

Does the method of Internet connection affect the security of your the network?

I was just visited by some door-to-door salesmen from a local ISP/TV/Phone provider. During our conversation, I raised some concerns about the fact that I knew their help desk techs had back-door ...
4
votes
1answer
512 views

Can I isolate a specific computer on my network?

My brother gets malware infections practically every week. Apparently he had a infection over the past 24 hours, I only noticed it because I checked the router logs and saw a massive amount of network ...
4
votes
0answers
39 views

How does BGP filtering work to prevent routing hijacking? [duplicate]

I've been reading for a while but yet do not properly understand how is BGP filtering used to prevent "attacks" such the recent Indosat's problem. Do not copy&paste Cisco's site, I have read all ...
4
votes
3answers
15k views

How to tell if you're being ARP poisoned?

I am having some issues at work and there is a new network admin in place. I think I am being monitored so decided to run ArpSpy X in two scenarios: Over WiFi bridge pluged into cisco router to took ...
4
votes
2answers
2k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
3
votes
2answers
843 views

Reveal the True IP of a User

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection? I.e.: To be able to uncover the true IP from transparent as well as ...
2
votes
3answers
2k views

DDoS on LAN: How to Defend?

DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...
2
votes
2answers
3k views

how to identify p2p on network

Im trying to work out if the traffic in the below image is P2P file sharing? If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
2
votes
2answers
2k views

Is it possible to change the admin user/password remotely on a router without logging in?

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
1
vote
2answers
261 views

Isolating guest networks

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network. Initially, I used IP filtering ...
1
vote
4answers
41k views

How to effectivily block torrents on my network?

Hie, As per my network policy, we have to block all torrent traffic from network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
0
votes
4answers
161 views

Basic question about why it's useful to have VPN encrypt traffic

There may be a basic flaw in my understanding of how the internet works so sorry if this is a simple question. What type of attack does VPN protect against? For example if a local area network (let's ...
19
votes
3answers
2k views

What are the risks of using a CDN to speed up my website? How do I avoid them?

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
10
votes
4answers
4k views

Is NTP vulnerable to DNS poisoning or spoofing attacks?

Scenario: Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application) Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...
9
votes
2answers
536 views

How does the Copyright Alert System work? Who has implemented it?

Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright. I'm concerned how this oversight relates to my private traffic, and what laws ...
8
votes
3answers
1k views

Secure PXE network OS installation

How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)? Would it be possible to ...
8
votes
1answer
10k views

Are open ports dangerous?

I have forwarded port 80 to WAMPServer and 25565 to the MineCraft-server running Bukkit. (http://www.bukkit.org/) Am I vulnerable to attacks. Can hackers attack me if WAMP-server is running or if it ...
7
votes
6answers
256 views

Why shouldn't I run other applications on a Firewall?

If I want to use Ubuntu 11.04 as a Firewall in SOHO environment, then I just can't figure out what is the bad thing about installing GUI on it (e.g.: XFCE)? The only opened port to the world (wan ...
7
votes
3answers
450 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
5
votes
2answers
3k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
5
votes
3answers
622 views

How did the spammers get this address?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
5
votes
2answers
1k views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
5
votes
5answers
6k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives

In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work: Dim WshNetwork Set WshNetwork = ...
5
votes
1answer
2k views

Is indirect access to a computer as bad as direct?

I'm deploying a web-based ERP system for a customer, such that both the server and the client machines will be inside the customer's intranet. I was advised not to allow the server machine to connect ...
5
votes
3answers
474 views

Is there a way to identify the host of a malicious VM from across the network?

Scenario: Someone is attacking your network. However, they're not exactly using their machine to do it - they're using a VM running on their system. The VM's network adapter is configured in ...
4
votes
3answers
3k views

Opensource NetFlow generator

Cisco routers are able to generate NetFlow flows that can be captured and then analyzed in order to manage what is going on on your network. Unfortunately, I don't have a Cisco router in my toolbox so ...
4
votes
2answers
2k views

incoming packets in server

I have enabled iptables logging for packets coming from the outside -A INPUT ! -s 192.168.218.0/24 -j LOG Now i am seeing lots of incoming packets from unknown addresses Jun 5 14:54:56 localhost ...
3
votes
1answer
597 views

What is known about the sirefef/zeroaccess malware/botnet?

There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
3
votes
1answer
620 views

Filtering network access on a user/group/process basis

I am interested in peoples thoughts on what the best approach would be to controlling access to network interfaces at a user/group/process level for a Linux based host. The scenario I have in mind is ...
3
votes
2answers
479 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
3
votes
2answers
2k views

What is more secure: ISDN, Cable Modem, DSL, T1, etc…?

This discussion came after showing a friend this Security.SE post regarding DNS attacks, and after reading about a Cable Modem MITM attack. Given the current options available to consumers, what ...
3
votes
4answers
328 views

What does a switched network protect us from? What does it not protect us from?

There seems to be some misconceptions regarding what a switched network will protect us from, and what technologies/precautions a secure environment requires when segmenting trusted users from hostile ...
2
votes
2answers
169 views

What are the advantages to using a VPN over secured/trusted wifi

It's often recommended that you should use a VPN when using unsecured or untrusted networks, such as open public wifi or secured wifi that you don't control. What are the advantages to using a VPN on ...
2
votes
3answers
2k views

Identify a process that uploads data

I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
2
votes
2answers
26k views

Router admin password was changed, how did this happen and how to prevent [closed]

Internet was extremely spotty for about a week. I was on/off cycling the cable model and router almost daily, before I tried to sign into my router (198.162.1.1). When I did I was presented with a ...
2
votes
4answers
602 views

Detecting and filtering data over AC power lines?

Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication? I'm not sure how difficult this is ...
2
votes
3answers
448 views

Repudiation in Copyright Infringement (BitTorrent)

Seeing this question : How can alleged illegal downloading be detected? sparked a question I have had for a long time. How does repudiation/non-repudiation work in such cases ? Argument: It is known ...