Network Security - securing network infrastructure and connections
2
votes
1answer
242 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
3
votes
3answers
209 views
Privacy issues in Peer to Peer networks
In any typical P2P file sharing app, say DC++, the typical operations are search content, push content and pull content. A peer node broadcasts/multicasts its query to fellow peers and receives ...
1
vote
6answers
197 views
Secure internet access while traveling
Given the risks of shared wi-fi as stated here, here and here, I would like to ask what are good practices for someone who is always traveling.
While having your own wi-fi with a strong WPA2 password ...
-1
votes
1answer
37 views
netflow capture of one subnet only? [closed]
is it possible to capture only one subnet of netflow traffic?
For instance: If a switch processes traffic of the subnet 10.1.x.x and 10.2.x.x, would it be possible to capture only traffic of 10.2.x.x ...
2
votes
2answers
155 views
Analyzing Network Anomalies for Malicious events
For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main ...
0
votes
1answer
202 views
DrayTek Vigor 2920 HTTPS allowed
In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups.
This all works fine, however we've discovered that all HTTPS ...
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
12
votes
3answers
1k views
Bruteforce attack on my FTP server
I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
10
votes
4answers
634 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
2
votes
4answers
362 views
How to Investigate Wi-Fi Intrusion and where to look for evidence?
I'm trying to figure out how to configure a network so that I can tell what an intruder did (in the past) while on the network after they are detected.
eg. If someone with a wi-fi enabled laptop ...
4
votes
1answer
93 views
Symbiote Counter-Attack Detection
I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
0
votes
3answers
269 views
Some issues with iptables and nmap
When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.
However I can use HTTP or SSH, so that ...
3
votes
3answers
19k views
Is Teredo in my router a back door?
I use the school computer, which I bought from school, administered by the IT-department. I opened a port to my computer when I stumbled upon this:
It points to my computer IP. (I have a static IP ...
3
votes
2answers
245 views
How effective is changing the MAC address?
Since every vendor has a MAC address range, and Apple has network card models that only they use (Airport), I suppose that it is very easy to identify a network package as coming from an Apple device, ...
4
votes
2answers
678 views
Fuzzing with SPIKE - the \r\n not being taken into account
I would like to fuzz FTP protocol, and currently I have the following:
s_read_packet();
s_string("USER test\r\n");
s_read_packet();
s_string("PASS test\r\n");
s_read_packet();
I've also tried ...
3
votes
2answers
622 views
How to use RC4 securely
I want to encrypt my network communications with RC4. The reason for choosing RC4 is the simple implementation and speed.
I need to have a pure Python implementation, because I cannot compile for my ...
5
votes
5answers
1k views
Is the US military secret network SIPRNet physically or cryptographicaly separated/secured?
I've read the Wikipedia articles on SIPRNet and NIPRNet (which are pretty light on details) and they are supposed to be considered separate. At the network level, are they technologically ...
2
votes
2answers
270 views
How was pentest performed in the era with no frameworks like Metasploit?
I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
0
votes
1answer
136 views
How do I use two different Public IP to add a new server to the DMZ? [closed]
My network looks something like this;
INTERNET»»ROUTER»»ASA FIREWALL»»»INTERNAL NETWORK
Right now, we are using a public IP in a range like for instance of 50.224.157.105, which we are using in the ...
2
votes
4answers
217 views
Detecting and filtering data over AC power lines?
Given that it's possible for the average consumer to send covert signals over normal AC lines how can an IT department identify and filter out this communication?
I'm not sure how difficult this is ...
0
votes
2answers
423 views
Block all internet access from a computer except for allowed applications and domains?
I want to block all internet access from a computer except for allowed applications and domains.
E.g.
BLOCK ALL
Except security.stackexchange.com/...
Except skype.exe
How can I do this?
-It needs to ...
2
votes
3answers
207 views
Identify a process that uploads data
I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
0
votes
2answers
157 views
Networking books for programmers [closed]
I have some programming experience, mostly in web apps, based on pre-existing frameworks. That is, all the networking side of things are handled already, and no knowledge of them is necessary.
I ...
5
votes
4answers
1k views
How to detect eavesdropping by your ISP
I've noticed some funny behavior lately with my home Internet connection such as connections dropping frequently, rate limiting occuring, and packet loss.
I know how to get around this online, use a ...
0
votes
2answers
144 views
Network security: Public and Private keys
In Pretty Good Privacy, it is said that Sender sends compressed message and encrypts the message with the private key of himself. And then Receiver will decrypt that message with the public key of the ...
11
votes
2answers
326 views
Network policies under AppArmor/SELinux
I am attempting to sandbox some untrusted processes using Linux's MAC frameworks -- either SELinux or AppArmor.
I see that both SELinux and AppArmor allow the selected granting of socket level access ...
2
votes
2answers
435 views
Restrict network access for a single process with SELinux or AppArmor
I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
2
votes
2answers
221 views
DNS cache poisoning
What are the things the attacker needs to know from the victim to perform DNS cache poisoning ?
for example : IP , Port number and Transaction number
what else ?
3
votes
1answer
271 views
Security of Openflow/SDN network
Openflow/SDN networks give a remote controller the ability to manage the behavior of network devices i.e. configurations. They can forward instruction sets to dynamically change network configuration. ...
-2
votes
1answer
63 views
Connecting to IP [closed]
It is possible to connect to multiple IPs at a time like when we are connected to LAN at the same time we can be connected to a Wireless connection. In this case does our network speed gets added or ...
4
votes
1answer
117 views
When should a DNS entry be cached? What conditions should not be? How do I determine the TTL?
I'm writing a DNS resolver and am building a spreadsheet of when a DNS record should be cached, and not be cached... but it's harder than it first looks (to me at least).
Is there consolidated test ...
1
vote
1answer
81 views
DNS Cache poisioning examples, or other criteria when a client ignores a response
Is there a concise set of rules that describe what 99% percent of DNS responders accept?
Conversely, are there are set of rules that define when DNS queries are invalid?
Example answer
I would ...
-1
votes
1answer
363 views
Designing DMZ(s) [closed]
I was wondering what would be the correct way to isolate servers in order to protect them and us from too much harm.
Let's have two scenarios:
1) Access to Application Server from the world
We have
...
2
votes
3answers
7k views
How to bypass restrictive mac address filtering on home network (not malicious)
Background
A short sketch of my situation before I formulate my question: I am on a large home network, which is privately administered by a couple of admins. The network consists of a lan and a ...
-1
votes
1answer
110 views
Unable to browse with my office Wireless network i am connected [closed]
I am unable to connect to the internet. I am behind a company router that requires authentication, and although I had provided it I am unable to connect out to the internet.
Everyone is able to ...
2
votes
1answer
121 views
Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)
My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model.
After reading Qualys's blog regarding slow TCP reading, I ...
0
votes
1answer
135 views
Windows Firewall accepts a three-second unicast response from any source
I have read this article but still has some doubts may be after that...
The Windows Firewall feature in Microsoft Windows XP Service Pack 2
(SP 2) accepts a three-second unicast response from ...
5
votes
2answers
325 views
Unidentified public network sending traffic through my computer
I'm having a problem with one of my computers. I suspect it's being used for something malicious.
A few weeks ago my internet connection went down, I called my ISP and they told me that no MAC adress ...
0
votes
1answer
126 views
How to Transfer packets from one ethernet card to another [closed]
I have a desktop with two ethernet(etho,eth1) cards and OSSIM installed in it. I have a laptop with webmin installed, where i want to write rules for transferring packets from eth1 to eth0. Both the ...
3
votes
2answers
2k views
Router admin password was changed, how did this happen and how to prevent [closed]
Internet was extremely spotty for about a week. I was on/off cycling the cable model and router almost daily, before I tried to sign into my router (198.162.1.1). When I did I was presented with a ...
2
votes
1answer
182 views
What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]
Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
1
vote
0answers
71 views
Secure DSL Modem/Gateway [closed]
I need a secure dsl modem. What I have found out over the last few months is that it is possible that a remote intruder, in lieu of being able to hack your computer itself, can gain control of the DSL ...
6
votes
2answers
675 views
How can I detect if someone is sniffing network packets on the LAN?
I would like to know if there is a product or software that can detect if there is a sniffer currently on the network?
In other words is it possible at all to detect if there is a network card on ...
0
votes
2answers
83 views
Setting up a remote test environment correctly
My setup:
- Main Box (connected to network)
- VM1 : Linux
- VM2 : Windows 7
Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating ...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
-3
votes
3answers
147 views
wireless security concern [closed]
My small office has Netgear Router (N300 DGN2200). I had it secured using "password" . So any computer which needed access had to give the security password. But today a outsider accessed my router ...
3
votes
1answer
359 views
Identifying device based on the MAC address
Suppose we know that MAC address A belongs to a certain device (say an iPhone 5), and MAC address B also belongs to an iPhone 5. If we have a MAC address C which is in between A and B, does this ...
1
vote
1answer
533 views
How to view which mac addresses are connected to some AP?
I set up an open AP. I know I can view mac addresses of connected users via AP's console (local console). this is not what I need.
I use tool like Netstumbler or inSSIDer on my Win 7 machine to see ...
1
vote
1answer
195 views
How to write Snort rules based on MAC address?
I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
0
votes
3answers
611 views
How to setup an internal firewall
I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to ...
