Network Security - securing network infrastructure and connections
8
votes
1answer
179 views
Are multiple network interface still recommended in a virtualized world?
Before the virtualization era, it was recommended to have several network card on a physical server :
1 for production dedicated network (only application's stream like
http, SQL*NET, ...)
1 for ...
2
votes
1answer
2k views
How does pfsense block torrent traffic?
I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
2
votes
3answers
218 views
Repudiation in Copyright Infringement (BitTorrent)
Seeing this question : How did an alleged illegal downloading be detected? sparked a question I have had for a long time.
How does repudiation/non-repudiation work in such cases ?
Argument: It is ...
1
vote
3answers
395 views
How can alleged illegal downloading be detected?
Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method?
Update
Using a honey pot or monitoring the peers list makes ...
10
votes
3answers
417 views
Is a predictable MAC address a risk?
If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
5
votes
1answer
160 views
Parabolic Denial Of Service — Would it work?
Would this DoS attack be effective:
Attacker determines target (10.0.0.1)
Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1
Servers reply to 10.0.0.1 with syn packets
...
1
vote
3answers
331 views
using network switches to prevent malicious promiscuous mode usage
I was reading the wiki about promiscuous mode when I came across a piece of information here that suggests that one could use network switches to prevent malicious use of promiscuous mode.
In the ...
9
votes
2answers
366 views
How does the Copyright Alert System work? Who has implemented it?
Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright.
I'm concerned how this oversight relates to my private traffic, and what laws ...
6
votes
2answers
287 views
What risks does WPA carry?
A family member of mine would like to be able to play old PSP games online. Unfortunately the device does not support WPA2, and my network is strictly WPA2 AES secured. What are the risks involved in ...
2
votes
1answer
158 views
Password authentication using DynamoDB
I'm working on a Mac app. I have users stored using DynamoDB.
Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
5
votes
2answers
303 views
How can I use nmap to distinguish between a normal linux machine and an android device?
According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.
2
votes
2answers
177 views
Enterprise IDS - Deployment & Uses
I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
8answers
3k views
How to block some websites in a small office?
I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites.
My current connection is ...
2
votes
1answer
195 views
SSL VPN placement strategies
I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations:
with firewall
within the internal network
within the DMZ
Any reference also ...
3
votes
3answers
209 views
Privacy issues in Peer to Peer networks
In any typical P2P file sharing app, say DC++, the typical operations are search content, push content and pull content. A peer node broadcasts/multicasts its query to fellow peers and receives ...
1
vote
1answer
481 views
By default, does a linksys router log connections?
Routers have many settings that allow it to be safe and secure for the users that are connected to that network. A lot of these settings have to be manually configured though, which includes ...
3
votes
2answers
219 views
Dirty and clean interface on DMZ gateways
We have a webservice border gateway in DMZ which handles incoming and outgoing webservice requests in terms of authentication and security.
We have two network interfaces in place, on is called ...
5
votes
3answers
269 views
Does NAT break source port randomization?
The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.
Does NAT break the security benefits of source port randomization?
In more detail, consider ...
0
votes
1answer
305 views
tcp dump vs fw monitor [closed]
TCPdump vs FW Monitor
What specific type of packets does the following TCPDUMP command capture?
tcpdump -nni 'tcp[tcpflags] & 4 = 4'
Can you get the same results from the “fw monitor” command ...
-1
votes
2answers
193 views
Precautions to be made while using Internet chat to prevent being hacked? [closed]
I have read many websites which state that, "We can hack into computers while chatting on the internet."
What are the best precautions to be taken while chatting to prevent unauthorized access?
I ...
2
votes
1answer
198 views
Best way to validate /etc/hosts from third party providers to avoid ads?
A lot of people use a huge /etc/hosts file to simply redirect ads and scam sites to 127.0.0.1. The interesting part about this approach is that you can have the same hosts on your tablet, your android ...
2
votes
2answers
356 views
DMZ and LAN data exchange - what direction should connections be made?
When configuring services in the DMZ to exchange data with the internal LAN which scenario would be more secure:
DMZ service pushes data to LAN service
or
LAN service pulls data from DMZ ...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
0
votes
1answer
117 views
adsl modem with the most security features [closed]
I am looking for the adsl modem with the most security features available. A 'least likely to be compromised', can be configured to be hack proof adsl modem with an internal firewall and other ...
1
vote
2answers
125 views
IP attack by reading/writing data?
If I remember correctly there is an ICMP attack whereby you can embed malicious code and it gets read/executed, causing the problem (similar to SQL injection).
Are there any further/more dangerous ...
-3
votes
1answer
172 views
How can cellular phones be eavesdropped on? [closed]
I know its really stupid question but one of my friend told me that he can listen to the guy who calling on his mobile phone without his phone being the one the call is controlled by.
What ways could ...
0
votes
0answers
71 views
If need to choose any IT certification exams or not? [closed]
I heard, if some one likes to take part in the IT area's job, he/she needs to pass some IT certification exams. Do I have go to do this? If yes, need I take Avaya certification exams?
5
votes
4answers
566 views
Ways to monitor someone's internet traffic
If some authority for whatever reason decides they want to monitor your traffic on a wired DSL connection, how would they do it besides exploiting your OS? What are the other ways assuming the OS is ...
10
votes
1answer
387 views
XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?
In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
2
votes
3answers
424 views
How to block the websites on client machines
In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like:
...
2
votes
2answers
204 views
AES CBC over TCP - when is new IV needed
I am working on a project where two devices will be communicating with AES with CBC over TCP.
We already have a secure mechanism for sharing the encryption/decryption key.
I am not sure if we need to ...
4
votes
1answer
86 views
What is the effect if a Cisco router is transmitting PDUs to an ISP?
I was recently tipped off by our ISP that our router is transmitting PDUs to their switch, and told that if we don't turn it off they might be able to penetrate our LAN. What do they mean that we are ...
1
vote
1answer
59 views
For SSL certs, is some sort of connection to the issuing CA (or other network resource) required for the SSL connection to be established?
I was reading an article on creating a certificate authority, and came up with this question when I came to the section entitled "Distribute your certificates and CRL".
Background:
I am deploying ...
0
votes
2answers
184 views
Easy way to analyse my netstats for intrusions?
I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway.
When I issue a netstat -a, I see various ...
5
votes
2answers
201 views
Suspicious 'upstream' traffic
We are seeing unusual amounts of traffic heading upstream on our WAN connection, during the day our system can exceed (or attempt to exceed) the 1Mbps limit imposed on the connection.
I have PRTG ...
2
votes
3answers
188 views
Without SSL, what vantage point does one need to MITM non-SSL'd HTTP?
OK, so there are two things here: being able to read the content of the requests and responses, and then being able to modify them. The former may depend on the latter, I'm not sure.
But basically, ...
1
vote
1answer
252 views
Examples for (Web-)Security-Architectures
I just started to work on my thesis to finish my studies. However the field in which I write my thesis is pretty much new to me. I have the task to build a "Remote-Access Strategy/Architecture" to ...
2
votes
1answer
242 views
What is known about the sirefef/zeroaccess malware/botnet?
There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
1
vote
1answer
532 views
How to view which mac addresses are connected to some AP?
I set up an open AP. I know I can view mac addresses of connected users via AP's console (local console). this is not what I need.
I use tool like Netstumbler or inSSIDer on my Win 7 machine to see ...
3
votes
1answer
177 views
How can you (anybody) find out the IP adress of a single computer inside college
How can you (anybody) find out the IP adress of a single computer inside college.
Every computer has the same public ip adress on college, so therefore, how is it possible after discovering that the ...
2
votes
2answers
852 views
How to set up a user-friendly NAS encryption?
We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
9
votes
1answer
332 views
Best way to report a foreigner attacker's ip to authorities?
I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?
From your experience what is the ...
0
votes
0answers
55 views
Can you port-scan a LAN, from outside the LAN? [duplicate]
Possible Duplicate:
Scanning A Subnet Externaly
Is it possible to scan ports on machines in a LAN, from outside that LAN?
For example, I've got machines in my LAN network and want to check ...
11
votes
6answers
2k views
Why is ARP poisoning killing all network activity?
Using ettercap and ARP poisoning, I was able to eavesdrop on other connections, but suddenly I was unable to make any connection to the Internet. To restore Internet connectivity, I had to restart my ...
2
votes
5answers
115 views
Documentation Platforms for Information Security Team
I am looking for ideas on documentation platforms focused specifically for information security and response teams. Is there anything that has worked well? What are some of the unique advantages of ...
5
votes
1answer
271 views
What level of anonymity do VPNs provide?
When I use VPN is entire Internet usage protected or only some subset of traffic? For example,
Is my IMAP email provider only going to see VPN's IP address?
Is my DNS provider only going to see ...
2
votes
2answers
209 views
Tools/methods helping to determine application/protocol serving specific port
I do blackbox testing of the server and figured out that there is a bunch of listening ports. I need to determine what services/protocols those ports are used for.
What I've tried so far is to use ...
4
votes
3answers
1k views
Doesn't an IP conflict occur when ARP spoofing?
I am playing around with Ettercap and ARP spoofing attacks. I have noticed that the computers that are involved in my attack not are displaying any messages telling that an IP conflict has occured.
...
1
vote
2answers
451 views
Can an insecure wifi connection block users who download a lot, from say: torrents or usenet? [closed]
Can an 'insecure community network' have automated features to block internet or slow speeds on computers which download a lot, from say: torrents or usenet?
I have two computers and one has ...
-3
votes
1answer
99 views
Insecure community network connection problems [closed]
I live at an apartment complex which provided free wifi. My problem is I cannot get a good signal in my bedroom. In the living room my desktop (with a wifi Rosewill PCI-e adapter) gets an excellent ...
