Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

8
votes
4answers
9k views

How to detect hosts running in virtual machines with nmap?

I have to determine if a given subnet has virtual hosts. Are there any ideas about what switches to use?
8
votes
1answer
838 views

What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?

What are the main issues and recommended controls when exposing SIP and H.323 to the Internet (could be for voice, video, and instant messaging traffic or all three)? Specifically I'm looking for ...
7
votes
3answers
81k views

How to monitor my home network traffic?

I have an ATT U-Verse Wireless router supplying 5 computers throughout my home. It is hardwired to my main computer. I have three children of all ages, one of which has had a tendency to make poor ...
3
votes
2answers
5k views

Using Cain and Abel to capture traffic of machine in the same network

I have installed Cain and Able in machine A, which is connected to another machine B via a LAN. Now I want to analyze all the traffic of machine B. Is this possible by installing Cain and Abel on ...
21
votes
4answers
2k views

IPsec (Internet Protocol Security) facts

Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
16
votes
4answers
3k views

Threat assesment for a captive portal

I am interested in setting up a captive portal on a wireless network. From what I understand I would do this by initially having all guests in a temporary vlan, moving them to the real vlan when ...
14
votes
3answers
19k views

How do I ensure data encryption on Samba transmission on *NIX systems?

I have a heterogeneous system (both MS and *nix) that communicates with CIFS/SMB. How can I ensure proper data encryption at the application layer?
14
votes
1answer
7k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
14
votes
3answers
4k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", "...
11
votes
3answers
1k views

What security measures should be taken when running a Linux web server out of our office?

I am interested in running our company's web server from our local office. The office makes use of file sharing and NAS devices among other common office protocols. The worst case scenarios I've ...
15
votes
2answers
1k views

Network policies under AppArmor/SELinux

I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor. I see that both SELinux and AppArmor allow the selected granting of socket level access ...
8
votes
6answers
2k views

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ...
8
votes
1answer
1k views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
4
votes
2answers
3k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
4
votes
3answers
221 views

Open ports with no services bound to them

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?
3
votes
2answers
2k views

What are the advantages to using a VPN over secured/trusted wifi

It's often recommended that you should use a VPN when using unsecured or untrusted networks, such as open public wifi or secured wifi that you don't control. What are the advantages to using a VPN on ...
23
votes
8answers
5k views

Is there a way to make a WEP-secured AP uncrackable?

For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack ...
22
votes
8answers
4k views

Is possible to get infected by only staying connected to the Internet (nothing else)?

I have a router and I'm the only user. I have a computer with Linux and a tablet with Windows 8.1. Because of a few problems, I had to reinstall Windows on the tablet. Since I'm a bit paranoid about ...
19
votes
4answers
2k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
13
votes
7answers
3k views

Egress filtering on an office network?

With an office network most companies will use ingress filtering to add a level of security, however few take advantage of egress filtering to protect their networks. The use of egress filtering will ...
12
votes
3answers
442 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
11
votes
4answers
884 views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
11
votes
1answer
1k views

How can I detect real location of the user through their IP address?

There were many ways to detect the user's IP, for instance we could get it through a single click link or through any other medium of communication where we could get the user's IP. But the tedious ...
9
votes
2answers
579 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
8
votes
2answers
10k views

Securing remotely accessible IP cameras that do not support HTTPS

I have some IP cameras set up on my home network, which is WPA2 protected. These cameras are setup to be accessible from the Internet thru my router's DDNS address, and port number. So for example, ...
7
votes
1answer
2k views

Security Operation Center (SOC)

I am looking for resources and details on establishing a security operation center (SoC) or network operation center (NoC) based on ITIL or any other applicable regulations. Where can I find good ...
7
votes
6answers
4k views

How to bypass Nmap blockage?

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside? Also, does blocking nmap on a network provide any security? ...
7
votes
3answers
6k views

What makes the Blackberry device and network more secure?

One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
6
votes
4answers
2k views

Email header IP address

Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?
6
votes
2answers
5k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
5
votes
5answers
429 views

Does the method of Internet connection affect the security of your the network?

I was just visited by some door-to-door salesmen from a local ISP/TV/Phone provider. During our conversation, I raised some concerns about the fact that I knew their help desk techs had back-door ...
4
votes
1answer
454 views

Security implications for two applications communicating with TCP/IP on localhost

Considering this for the local loopback connection: - It is implemented entirely within the operating system's networking software and passes no packets to any network interface controller. If ...
3
votes
5answers
2k views

Building my own Darkspace

I have searched through the internet about creating a darknet and there is a confusion. There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
3
votes
1answer
275 views

Setting up a honeypot to detect malicious network activity

So in the world of networks, people try to gain access to the client machine and perform lateral movement. Honeypots are often used to give them an easy access point and show them an unfavorable or ...
3
votes
3answers
3k views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
2
votes
3answers
5k views

Is there an alternative to TCP/IP that encrypts end-to-end?

If there was a communication protocol that encrypts at the very low-level, this would solve the problem of wiretapping entirely and for all.
2
votes
2answers
256 views

Spoof another IP address in the same network,will the spoofing source get the response?

I have read some articles about IP spoofing. Briefly speaking, IP-spoofing means the attacker uses a fake IP address in the IP header, to pretend this IP packet is sent by another machine. The ...
1
vote
5answers
93k views

How to effectivily block torrents on my network?

Hie, As per my network policy, we have to block all torrent traffic from network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
13
votes
2answers
763 views

How does the Copyright Alert System work? Who has implemented it?

Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright. I'm concerned how this oversight relates to my private traffic, and what laws ...
12
votes
4answers
6k views

Is NTP vulnerable to DNS poisoning or spoofing attacks?

Scenario: Attacker somehow compromises the DNS lookup for the NTP server used by the victim (a web application) Victim sends DNS request for e.g. ntp.pool.org, which is responded to by attacker to ...
11
votes
4answers
9k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
11
votes
3answers
848 views

Would publishing a network diagram make the network less secure?

I have found some social networking sites that focus on sharing architecture (network maps and diagrams) and configuration. Does sharing this type of information decrease the security of my network? ...
9
votes
2answers
3k views

How bad is the leaking of Internal IP addresses through external DNS

If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage? Apart from most the obvious - gaining an understanding ...
9
votes
3answers
7k views

Security measures for a WiFi access point?

I am planning to purchase a program that comes with an App that allows you to control the program via phone. The developer told me that the connection will be done via an extra WIFI box connecting to ...
9
votes
3answers
2k views

Secure PXE network OS installation

How can one make sure that when PXE is being used to boot a remote operating system, that the data being sent is encrypted (or at the very least that integrity is maintained)? Would it be possible to ...
8
votes
2answers
2k views

How do the root servers get updated with my name server? Is WhoIS information always in sync with the root?

I've never understood what happens behind the scenes when I go to my registrar and enter in my name server's information. Can someone elaborate on what happens when an update is made, and how it is ...
8
votes
3answers
7k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
5
votes
1answer
1k views

Can I isolate a specific computer on my network?

My brother gets malware infections practically every week. Apparently he had a infection over the past 24 hours, I only noticed it because I checked the router logs and saw a massive amount of network ...
5
votes
5answers
7k views

Does using WPA2-Enterprise just change the attack model vs WPA2-PSK?

As far as I can tell based on the reading I've done so far, WPA2-Enterprise uses the same encryption and security algorithms and methods as WPA2-PSK, with the addition of using another service for ...
4
votes
3answers
308 views

How does a Man In the Middle attack happen in reality

I am trying to improve the MITM protection of an iOS app I am responsible for, so I want to understand exactly how it happens. I have set up Charles to act as a proxy which required setting the proxy ...