Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

7
votes
1answer
1k views

Why would a switch be configured to Fail Open?

I can't understand why a switch would be configured to Fail Open? Surely an attacker could easily exploit this by MAC Flooding which will cause the switch to act like a hub and broadcast messages to ...
1
vote
2answers
165 views

Shared Office Network Security - VPNs, Firewalls, and systems

First, let me premise this post with the fact that I am completely new to network security. I have done a fair bit of reading up, but I am certainly by no means a professional. If anything I say here ...
3
votes
1answer
87 views

VPN Authentication and Network Administrators

Is it possible for a network admin (or attacker) to monitor traffic sent to a VPN server during authentication and end up being able to decrypt the data as if they were the legitimate user? I don't ...
3
votes
1answer
259 views

Is UPnP still insecure?

Here's my question: In today's world, on equipment that is properly updated to the latest software/firmware, is UPnP still insecure, or have its vulnerabilities been fixed? This type of question ...
2
votes
4answers
205 views

How could online encryption ever work? [duplicate]

I have recently read about the german enigma machine in WW2, It worked in a way that every day the machine configuration was sent per mail to the different operators. (I couldn't find official sources ...
5
votes
3answers
1k views

How do RATs access computers through routers?

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are ...
42
votes
6answers
184k views

If someone hacks my wi-fi password, what can they see and how?

If someone knows my wifi password (be it WEP or WPA) what can they see? Do they just see URLs I visit, or can they see everything in my browser, or even everything I do on my computer? Does using ...
17
votes
1answer
5k views

Is it even possible to hack a television channel?

In spite of all the hacking news in the recent few years I never heard of someone who managed to hack a TV channel. What makes them so secure?
2
votes
2answers
42 views

Why do ALGs restrict traffic on a given TCP port based on the protocol?

My understanding is that application level gateways restrict the traffic they proxy based on port and protocol - say HTTP over port 80 or MQTT over port 1883. Both types of traffic are using TCP as ...
1
vote
2answers
772 views

Attacking a server on port 80 while only port 22 is open on the firewall

There is a question bugging me a after reading on network security. Theoretical situation: there is a packet-filtering firewall, which only accepts tcp/ip communication with destination port 22 on a ...
41
votes
0answers
1k views

WPA2 ephemeral key derivation

I'm trying to learn how ephemeral keys in WPA2 4-way handshake are derived. Starting from 4 EAPOL packets sniffing, I successfully derived PMK and PTK reading ANonce, SNonce, and knowing ASCII-PSK ...
0
votes
0answers
62 views

From a topological point of view, are there any network structures which weaken a DDoS attack?

I am aware that I am doing some abstractions here (link-layer-3/link-layer-2 and router topology comparison, for instance). However, I wonder if there are any network structures (so-called graphlets/...
0
votes
2answers
95 views

Wipe out or dissapear and start over again in internet for personal security? [duplicate]

The other I was talking with a work mate that is part of finances and He made a question that I couldn't answer at the moment. "I have a lot of accounts and information about me internet. I'm really ...
0
votes
2answers
111 views

How to capture Wifi 802.11 traffic?

I want to capture the wifi traffic from my wireless card, so what i have to do and are there tools for that? I know that there is aircrack-ng and airodump, but these tools need a extra wireless ...
1
vote
1answer
29 views

Network authentication using router firmware scripting [closed]

To connect to internet in our institute, you need to login with your credentials on a page and then approve the IP address for proxy less usage. On a router, if one device authenticates, all the other ...
3
votes
1answer
57 views

One of my open files turned into a list of URLs and codes after clicking a link on a phishing email?

So I received a non-filtered email earlier today supposedly from Itunes under my email address with an invoice for Netflix subscription. Some of the links were genuine, but ultimately I clicked on a ...
11
votes
4answers
9k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
1
vote
3answers
356 views

Security risk of connecting one mobile device to another mobile device's hotspot

Is there any risk when connecting an Android Phone to a [Verizon] iPhone's Hotspot? If there are I'd like to know about solutions. The Android Phone will basically be tapping the data plan of the ...
2
votes
6answers
17k views

How to properly encrypt a communication channel between a client and a server (without SSL)?

I have a poor knowledge in the world of cryptography, I'm just starting to learn it so I'm a newbie :) As a project for getting into the field of cryptography I want to write a client\server program ...
0
votes
1answer
103 views

How can an attacker eavesdrop on users in public WIFI?

I want know why it's said that public WIFI is not safe for banking transactions or entering password for online accounts etc. I want to imitate an attacker and try to harvest as much information as I ...
2
votes
0answers
60 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
7
votes
1answer
145 views

How to spare file server data from being held hostage by client ransomware?

Suppose in a network there is a file server which's storage is shared between all workstations and all users require full read/write access to this storage for their cooperation workflow. (Over samba, ...
1
vote
2answers
138 views

Sniff network packets that don't talk to my computer?

How would one sniff wireless network packets that do not pass directly through my computer- without access the the AP or router? I want to be able to sniff for network traffic (even while ...
3
votes
2answers
56 views

Is ignoring share permissions ok?

For my small home network I've found that it is easiest to setup network shares with share permissions set to Everyone: Full Control share permission and then configure the NTFS permissions according ...
3
votes
1answer
89 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
4
votes
3answers
199 views

Why is it dangerous to let an internal server talk to the internet (to a specific IP)?

Sort of a basic question, but if we have an internal server and want it to talk externally, for example to get new packages. This environment normally does not have access to the internet. I've heard ...
2
votes
3answers
143 views

Which are the most important RFCs when learning security? [closed]

I was reading some security related blogs and write ups in internet and I started going for the RFCs instead, but they are huge, therefore impossible to learn all of them. I see those below as very ...
1
vote
1answer
106 views

MITM attack on WPA-PSK using fake AP: Can the password be intercepted from normal Windows AP-logon mechanism?

I have already tested how to do a MITM attack, using a fake AP to intercept the WPA-PSK, by presenting the user to a vendor (e.g. Linksys) logon page, before routing network traffic through eth0. ...
1
vote
1answer
47 views

Retrieving malware report information from malware network

I'm getting ready to stand up an isolated malware network at the place I work for performing analysis tasks and it will have a suite of reverse-engineering and analysis tools on it. For obvious ...
4
votes
2answers
162 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
5
votes
1answer
122 views

Anonymity while “attacking” a target [closed]

I'm very interested to the security topic, but sometimes I fail in understanding how a hacker would be successful like for example a group that recently claimed they got data from FBI. I wonder ...
0
votes
0answers
27 views

Windows : security of USBNET / RNDIS

I'm having trouble finding documentation about how to setup any security for RNDIS or if the system is already secure enough. For those who doesn't know RNDIS is a protocol that permits a USB ...
0
votes
1answer
237 views

Android devices are unable to connect to Rogue Acces point created using Airbase-ng

I have created a rogue access point using airbase-ng, but I can't connect to it using my android phones (note II, S4), when I tap on the access point all I get is: Obtaining IP address...', than ...
1
vote
2answers
94 views

How to evaluate a wireless network risk level?

When travelling everyone has to use structural wireless networks (managed by airports, hotels, museums, restaurants…). Some of these only open (80|443)/tcp/ip once you have provided an E-mail or ...
1
vote
2answers
68 views

Security risk of a service that allows a user to test from connectivity from a server to a printer

What are the security risks in adding a feature to an application which allows users to test for connectivity from a server to a printer? I'm planning to add a feature to my application to allow ...
1
vote
0answers
158 views

Attackers on sc.imp.live.com [closed]

"Deceptive site ahead Attackers on sc.imp.live.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone ...
11
votes
2answers
5k views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
3
votes
0answers
137 views

Different IPv4 numbers from different browsers, same computer

If I search on Google the words "my ip" using Firefox, Google returns a IP that belongs to my ISP: About 447,000,000 results (0.46 seconds) 200.x.x.x Your public IP address But, if I made the ...
89
votes
8answers
12k views

How can I protect my internet-connected devices from discovery by Shodan?

There's been a lot of buzz around this recent CNN article about Shodan, a search engine that can find and allow access to unsecured internet-connected devices. Shodan runs 24/7 and collects ...
60
votes
4answers
6k views

Why should servers be placed outside of the corporate network?

In an answer to How do you deal with massive port scans?, user tylerl said: ... And you, like a wise IT admin, run all your servers elsewhere on the internet, not inside your corp network, for a ...
6
votes
7answers
2k views

What security risks exist in cell phone apps' data transfer?

Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
16
votes
3answers
5k views

Running windows in virtual machine, should I bother with security?

I'm running Windows in a virtual machine on my mac (via Parallels). Should I bother installing antivirus, firewall and using other conventional wisdom practices (like don't open unknown .exe etc)? I ...
2
votes
3answers
171 views

Using more routers makes my PC safer?

I have a router and my ISP provided me a new router. Makes sense using the two as PC -> router1 -> router2(internet) or I'm just slowing (small, 1 or 2ms) my internet for nothing?
19
votes
4answers
2k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
-2
votes
1answer
56 views

How to add scripts in HTML file passing through network? [closed]

how to add JavaScript file to every HTML document that is passing through your network ?
27
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
1
vote
0answers
35 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
4
votes
3answers
221 views

Open ports with no services bound to them

I have been wondering: if a port is open for inbound connections on the firewall yet there is no service bound to it, would that be considered a security vulnerability?
1
vote
1answer
169 views

What are the advantages and disadvantages of installing an operating system through network? [duplicate]

Netboot is a technology that allows a computer to boot through the network, instead of starting on a hard drive, USB stick or DVD, it connects to a remote server to retrieve a disk image to start. It ...
2
votes
2answers
300 views

Performing an airport scan on my Mac for available WiFi networks pulls up multiple SSID with different mac address. What's going on?

I performed the following command to search for available WiFi networks in my apartment complex: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport scan | grep OBC I ...