Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

3
votes
1answer
170 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
1
vote
1answer
191 views

How can I convert a Windows certificate into a PEM format, that includes the chain + root?

I need to import a certificate into a Cisco Ironport for Web SSL inspection. The only input format supported is PEM. Based on my research the PEM format does support all certificates in the chain, ...
5
votes
3answers
659 views

Organization like OWASP for network security?

Is there something like OWASP for Network Security ? Or have anyone of you come across a testing guide for network security, as to how to start an audit and then the minimum number of tests to run ...
2
votes
1answer
47 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
16
votes
3answers
1k views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
3
votes
1answer
190 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
2
votes
4answers
77 views

Find the destination script of an inbound TCP connection on our shared webserver

We have a shared webserver which is being monitored constantly by our ZABBIX agent. On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address ...
32
votes
4answers
5k views

Is there any meaning in only allowing port 80 and 443 today?

It's become standard fare for security minded organisations to block everything other than 80 and 443. As a result, more and more applications (other than web browsers) are learning to use these ports ...
1
vote
4answers
5k views

Ignoring broadcasts to 10.0.0.255 using iptables

I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules: $IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP $IPTABLES -A FORWARD -d 10.0.0.255 -j DROP It ...
2
votes
2answers
105 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
-4
votes
1answer
118 views

How The Sony Hack Was Traced, and So Quickly? [closed]

What are the steps that are required to locate a source that have routed their traffic through multiple zombie hosts, spanning multiple networks/carrier/nations?
0
votes
2answers
103 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
2
votes
1answer
201 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...
0
votes
1answer
136 views

Why is browsing while logged onto a VPN from public wifi more secure than not?

I've been trying to wrap my brain around VPNs for a while now, but can't find a good source that answers the questions I have. In particular, I can't understand why browsing from a public access ...
2
votes
1answer
134 views

DNS Cache poisioning examples, or other criteria when a client ignores a response

Is there a concise set of rules that describe what 99% percent of DNS responders accept? Conversely, are there are set of rules that define when DNS queries are invalid? I would think that the ...
0
votes
3answers
139 views

How are computers identified across networks?

IP addresses are assigned to computers when they connect to the internet and change depending on your location. However, I read that your computer also has an address that doesn't change. So, when ...
36
votes
9answers
18k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
1
vote
2answers
333 views

When do I use IPsec tunnel mode or transport mode?

I basically understand how tunnel mode and transport mode works, but I don't know when I should use one instead of another. Among the two parties who want to communicate, if one computer B doesn't ...
4
votes
2answers
151 views

Is HTTPS redirecting to HTTP a vulnerability?

Let's say a user is authenticated, and the entire account authentication process happened under secure HTTPS. Upon successful login, the user is redirected back to the homepage. However, the homepage ...
2
votes
1answer
86 views

Does having a VPN service mean accessing my email etc. over public free open WiFi mean I have security/privacy? [duplicate]

Is my information secure over public WiFi if I use a VPN service? i.e. protection of emails and login details.
8
votes
5answers
1k views

What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?

I am writing a novel in which a researcher attempts to work against a study he is a part of by purposely sabotaging operations on the research compound. I am wondering if the following is plausible. ...
37
votes
4answers
5k views

Can a neighbour who installed my router access it?

I have a bit of a security concern. I'm concerned that my neighbor sees everything on my computer, web sites I have visited, my passwords, etc. Background: He installed a Linksys router in my house ...
-2
votes
3answers
795 views

How to hide my ip and browsing history from others on my network?

I need to hide my activity and IP address from those I share this network with. I'm unsure if a VPN will serve my needs, because I'm not concerned about the sites I access tracking me. I'm concerned ...
1
vote
4answers
184 views

Strange device in routers client list

Due to a high number of clients connected to one of my routers I recently changed it's password and reboot it. I also disabled WPS. The router is a ZyXEL Prestige 660. After the reboot the client ...
0
votes
2answers
1k views

DrayTek Vigor 2920 HTTPS allowed

In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups. This all works fine, however we've discovered that all HTTPS ...
0
votes
1answer
492 views

JUNIPER Junos Pulse - how to apply policy to device

We'd like to set up and use Juniper Junos Pulse on iphone and ipad for access to Corporate mail. We have juniper SA and have prepared the policy, but how do we apply the policy to the devices?
8
votes
3answers
147 views

What are the risks to a network if a single computer is compromised?

If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
9
votes
2answers
10k views

Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?

is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks. If it can, how, but if not, is there another ...
2
votes
2answers
191 views

What are the advantages to using a VPN over secured/trusted wifi

It's often recommended that you should use a VPN when using unsecured or untrusted networks, such as open public wifi or secured wifi that you don't control. What are the advantages to using a VPN on ...
2
votes
1answer
77 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
2
votes
3answers
633 views

How to know what others browse through the network?

My friend connected to WIFI and after 5 minutes he told me which sites I had actually been browsing, and who I chat with. My question is: how do I defend myself against this, and also how did he do ...
1
vote
1answer
387 views

Is there a way to block all TOR traffic incident on my public servers?

I don't want any connections coming from a tor network to be accepted by my servers.
0
votes
1answer
30 views

Unsecured Guest access on Macbook Pro

I am concerned that my personal, home based Macbook Pro guest network access may be being used by an outside source. Is there a way for me to identify user access, time logged in / out, etc?
0
votes
1answer
87 views

What's a least-privilege way to allow node.js to access network adapters on Linux?

Linux naturally restricts all but superuser from pulling traffic directly from network adapters. In the case of Wireshark/dumpcap, setuid root is used ONLY for dumpcap, restricting the privileges ...
1
vote
1answer
404 views

Attacking a server on port 80 while only port 22 is open on the firewall

There is a question bugging me a after reading on network security. Theoretical situation: there is a packet-filtering firewall, which only accepts tcp/ip communication with destination port 22 on a ...
0
votes
2answers
682 views

connecting a secure computer directly to the internet without a router

If you have a fairly secure computer how dangerous is it to connect to a modem directly without a router in between. Let's say the computer is running Debian as a host and Whonix in VirtualBox, a VPN ...
1
vote
1answer
95 views

How can I implement a whitelist based on packet content?

At the moment I am looking for some way on Linux to have packet filter whitelisting done but based on fine-grained parameters such as packet content rather than more general parameters such as ...
1
vote
3answers
640 views

What is same site scripting and what are some exploit scenarios?

I know it is an issue with how DNS is configured , but is it really dangerous if the attacker couldn't access your network?
0
votes
4answers
166 views

Basic question about why it's useful to have VPN encrypt traffic

There may be a basic flaw in my understanding of how the internet works so sorry if this is a simple question. What type of attack does VPN protect against? For example if a local area network (let's ...
3
votes
4answers
256 views

How much of a risk to students is an open WiFi network on campus? EDIT: please read in full.

I've been battling bureaucracy at my community college for months on this issue; a few months ago, they changed security on the SSID for students; It used to use EAP, allowing students to enter their ...
0
votes
1answer
648 views

How to test for zone transfer? [duplicate]

I heard that it is possible to test for zone transfer attacks on a web application using host and dig commands in Linux. How it is done?
3
votes
1answer
359 views

Security of Openflow/SDN network

Openflow/SDN networks give a remote controller the ability to manage the behavior of network devices i.e. configurations. They can forward instruction sets to dynamically change network configuration. ...
9
votes
3answers
2k views

Is it possible that authorities can't block a certain website

I was watching a very recent TV show, the FBI agent told the police that there is no way for anybody to block a live stream of a pedophile torturing a kid nor to trace it. Even when it's being ...
0
votes
1answer
182 views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...
3
votes
4answers
4k views

Should I enable domain authentication in my DMZ

Traditionally at my place of work we have an internal subnet that is completely protected behind our firewall. No ports are allowed to be opened to direct connections from the public network. We also ...
7
votes
4answers
5k views

Is the US military secret network SIPRNet physically or cryptographicaly separated/secured?

I've read the Wikipedia articles on SIPRNet and NIPRNet (which are pretty light on details) and they are supposed to be considered separate. At the network level, are they technologically ...
2
votes
1answer
2k views

How to secure my network, laptop, ipad and email accounts which are possibly hacked?

Background Last month I noticed lots of failed emails in my inbox and after few minutes I lost my access to my Yahoo Mail. My friends informed me that they have received spam emails from me. So I ...
5
votes
3answers
954 views

What are the risks of making ether-wake available to all users?

The Linux ether-wake utility, which creates a magic packet to wake on lan another machine, requires root access: $ether-wake 12:34:56:78:9A:BC ether-wake: This program must be run as root. To give ...
0
votes
2answers
149 views

How to be sure that downloaded file is correct? [duplicate]

Last week I read a lot about security. I have a basic understanding how public keys or private keys works. But I still have a lot of questions I can't find an answer. Right now I'm interested in ...
26
votes
2answers
3k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...