Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

1
vote
2answers
189 views

How to retrieve the MAC address of a remote IP [closed]

I have an IP address, and I want to find the corresponding MAC address. The IP address is in the same city, so we're connecting to the same network. How do I find the corresponding MAC address?
1
vote
1answer
92 views

How can the sybil attack be used on a P2P system that implements DHT?

I was reading about the sybil attack and am unclear on some details. After becoming part of the peer-to-peer network, the adversary may then overhear communications or act maliciously. By ...
4
votes
3answers
7k views

Securing a network attached storage on the internet

I recently purchased a network attached storage for personal file storage and would like my family members to store files on the device from their computers as a remote backup. I'd like to secure ...
22
votes
4answers
6k views

Are popular porn sites more likely to be infected with malware?

I'm trying to help my friend understand this because he believes that since a site is very popular, that it's less likely to infect its viewers because of its security! Is a popular site less likely ...
24
votes
6answers
22k views

Security risk of PING?

I have been told that PING presents a security risk, and it's a good idea to disable/block it on production web servers. Some research tells me that there are indeed security risks. Is it common ...
0
votes
1answer
1k views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
0
votes
3answers
126 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
3
votes
1answer
203 views

What constitutes an exploit? I was able to compromise my common household router

Was setting up Wifi at home today (just using the default router Time Warner Cable provides) and was appalled at the minimal security that the web server provides. Default user name/password is ...
0
votes
3answers
144 views

Decrypting SSL over a Mobile Network

I work for a large company and we are trying to judge the safety of some proprietary information that is being sent and received in a new application we are developing. After our initial testing we ...
0
votes
0answers
67 views

Is WPA practically less secure than WPA2 only if QoS is enabled?

I've been looking into attacks that are effective against WPA-TKIP but not WPA2-AES (both using PSK). I've found Vanhoef & Piessens's paper that builds off an attack by Beck & Tews and can be ...
13
votes
2answers
1k views

What's the diff between blocking a port with a firewall and not starting a service on that port in the first place?

I was considering setting up a software firewall (pf) on my web server and did some research on them. Were I to do it, it'd involve basically blocking connections to all ports except 80, 443, and the ...
0
votes
1answer
55 views

Segregating network systems and functions [closed]

I want to segregate network systems and functions so that if an attacker hacks in one area, he can't necessarily reach others. What should be the recommendation when information from one network is a ...
3
votes
1answer
156 views

Securing my network: unmasking spoofed mac possible?

In Kali you can: airmon-ng start wlan0 ifconfig mon0 down macchanger -r mon0 (-r changes mac id to a random number) ifconfig mon0 up This attack for example: aireplay-ng -0 2 -a [ap mac #] -c ...
47
votes
6answers
17k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
1
vote
1answer
221 views

Security criteria for selecting a network switch?

I am looking to purchase a switch with 24+ ports. The set of security criteria that I should bear in mind when selecting a switch is not clear to me. I have tried to take other networking security ...
1
vote
1answer
69 views

How safe are networking ACLs based on IP-address?

As far as I know, a determined attacker would have no major issues in hacking the IP address of the packets contained by his (web) request. Therefore, I cannot see how an Access Control List (such as ...
1
vote
2answers
225 views

In detail, how does SSL offloading/acceleration/termination work?

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject. Assume the following example, where a intends to ...
1
vote
0answers
83 views

Two similar computeres on same network, different traceroutes (one slow - one fast) [closed]

My SO's computer has a very slow internet connection. So I compared her traceroute to xkcd.com with mine. We are on the same network, on both on os-x. It's a simple 4g home router. tracerouter ...
0
votes
1answer
82 views

Why do private networks use both X.509 and User/Password authentication

For example, the school network I am on requires both a name & password to log in along with having its X.509 certificate installed in my browser. Why does it need both? Shouldn't name and ...
0
votes
3answers
112 views

Can the packets of a wireless network be sniffed by a user who is not present in that network?

1.If an user knows the frequency used by a wireless network, is he able to collect the packets from that network? Those packets may be encrypted, but can he collect those packets? 2.If the user has ...
0
votes
1answer
108 views

Compromised submarine cables and the consequences to internet?

I recently read an article that Google wants to build a submarine cable connecting to my country supposedly to increase overall speed and while I hope my government will never allow this kind of thing ...
2
votes
2answers
2k views

hide dhcp/ip request, traffic under lan router

I have a question on the following scenario: Lets say, we have a normal LAN network with 192.168.1.1/24 gateway, DNS, DHCP servers all running on 192.168.1.1 ; There is only one client: ...
8
votes
1answer
688 views

What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?

What are the main issues and recommended controls when exposing SIP and H.323 to the Internet (could be for voice, video, and instant messaging traffic or all three)? Specifically I'm looking for ...
32
votes
3answers
6k views

What is the best home wireless network encryption algorithm to use?

What is the best home wireless network encryption algorithm to use? I realize the best answer will probably change over time, and hopefully people can provide updated answers as new standards come ...
0
votes
1answer
127 views

Puzzle: network intrusion or OpenDNS/Disconnect.me collision?

My home / home-office network uses OpenDNS as a content filter. As the OpenDNS admin, I received a "User wants access to..." email indicating that someone tried to access a blocked site and requested ...
-1
votes
1answer
15k views

How to get a Network's WIFI Password through CMD? [closed]

I found that Wifi's Password can be retrived using the network and sharing wizard in Windows, And Technicaly theres no way to store Passwords/collection of bytes in the memory after switching/shutting ...
1
vote
2answers
108 views

Am I exposing my application to IP address forgery / ip spoofing?

Here is my setup: I will create two REST services that are run on Server B and should only be called from Server A. Both servers are on the same network and I am not able to configure a firewall to ...
1
vote
1answer
54 views

How do you practically manage your never-use-personal-accounts-on-a-work-machine-ever double life, when your personal machine is a limited iOS device? [closed]

This is follow-up to Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace? The answer to that question is Follow company security ...
2
votes
3answers
161 views

Parallel systems, in case any of two has known exploits

As software becomes more and more complex it's harder and harder to keep it secure down the entire line. Discussing this problem with a friend we were opting some pretty extreme solutions and wondered ...
0
votes
1answer
94 views

Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace?

I have just started interviewing for new computer job after years of working from home. At home I feel very secure with how I protect myself from data loss and keeping my secrets secure. I backup ...
1
vote
2answers
262 views

Is a sensitive NAS behind a router safe?

I have four pcs connected to a switch connected to a router that gets connected directly to the internet. How safe is a NAS attached to the same router along with the switch plug? I'd like to have ...
13
votes
5answers
16k views

Why is WPA Enterprise more secure than WPA2?

In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
7
votes
4answers
1k views

Verify Mac firmware is not hacked…how to do?

I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards. Normally, Little Snitch will report every app that uses the internet. Every ...
3
votes
1answer
299 views

Sticky keys on RDP

A recent report on page 18 states that: [black hats] have even leveraged [systems administration tools] as a means of maintaining additional persistence via setting “sticky keys” for RDP sessions. ...
1
vote
3answers
70 views

What Mechanisms Keep Network Processes (and Applications) Sandboxed

This question stems from my other question, sorry if it is too similar. Now I would like to know what mechanism is used to sandbox network processes and (if relevant) individual programs, if at all? ...
1
vote
3answers
95 views

What security implications are there when sending video feed over unknown applications, and how can we protect ourselves?

This might sound broad -- but it has to be considering the details are truly unknown. Context: Our university (and many more) have begun rolling out mandatory webcam recording for certain portions of ...
-1
votes
2answers
844 views

How to make Reaver crack WPS faster [closed]

I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
3
votes
1answer
195 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
1
vote
1answer
275 views

How can I convert a Windows certificate into a PEM format, that includes the chain + root?

I need to import a certificate into a Cisco Ironport for Web SSL inspection. The only input format supported is PEM. Based on my research the PEM format does support all certificates in the chain, ...
5
votes
3answers
725 views

Organization like OWASP for network security?

Is there something like OWASP for Network Security ? Or have anyone of you come across a testing guide for network security, as to how to start an audit and then the minimum number of tests to run ...
2
votes
1answer
56 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
16
votes
3answers
1k views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
3
votes
1answer
216 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
2
votes
4answers
92 views

Find the destination script of an inbound TCP connection on our shared webserver

We have a shared webserver which is being monitored constantly by our ZABBIX agent. On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address ...
32
votes
4answers
7k views

Is there any meaning in only allowing port 80 and 443 today?

It's become standard fare for security minded organisations to block everything other than 80 and 443. As a result, more and more applications (other than web browsers) are learning to use these ports ...
1
vote
4answers
5k views

Ignoring broadcasts to 10.0.0.255 using iptables

I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules: $IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP $IPTABLES -A FORWARD -d 10.0.0.255 -j DROP It ...
2
votes
2answers
146 views

Connecting trusted and untrusted networks

We have two domains that are isolated. First domain is the Corp LAN, the second is an hostile untrusted network with untrusted clients that could contain malware. Clients on the untrusted network ...
-4
votes
1answer
121 views

How The Sony Hack Was Traced, and So Quickly? [closed]

What are the steps that are required to locate a source that have routed their traffic through multiple zombie hosts, spanning multiple networks/carrier/nations?
0
votes
2answers
117 views

Only HTTP(S) port is open. Why do I need to worry about unpatched software?

Unpatched software poses no risk by themselves. They're only problematic when someone exploits it. How could malware get into my system if I do have unpatched software in general and I'm connected to ...
2
votes
1answer
204 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...