Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

11
votes
1answer
587 views

How can I detect real location of the user through their IP address?

There were many ways to detect the user's IP, for instance we could get it through a single click link or through any other medium of communication where we could get the user's IP. But the tedious ...
6
votes
1answer
547 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
4
votes
1answer
58 views

Which protocols employ cover traffic

Do the protocols employed by wpa 2 and vpns use "cover traffic". A constant busy signal that would not allow for meta data analysis. If not is there a service that does this for you.
0
votes
2answers
150 views

Is hack.chat safe from packet sniffing?

So I recently found this tool called hack.chat. It's a disposable, browser-based IM system. If I were to use this at a friends house, public network, or at work, it is possible for someone on the ...
3
votes
2answers
135 views

Intercepted encrypted traffic

If your internet connection is encrypted, will snoopers still be able to tell when you are active; for example, clicking a link as opposed to merely reading a webpage. Will a snopper be able to see ...
12
votes
1answer
2k views

What's are the advantages of L2TP/IPSEC over plain IPSEC?

As the title says, my firewall (Sonicwall) can do either IPSEC or L2TP/IPSEC for VPN connections. One advantage of L2TP/IPSEC I can see is that the client computer get allocated its own IP address on ...
4
votes
2answers
4k views

What's the difference between an application-level and circuit-level gateway?

From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic. But I ...
4
votes
0answers
176 views

Is the GTK or MIC in the unencrypted portion of a WPA protected frame?

In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to ...
3
votes
0answers
104 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
1
vote
1answer
140 views

Traffic anonymization through routing - software and algorithms

I stumbled upon an interview with "the grugq" in which he is talking about how hackers anonymize their traffic, i.e. hide their original ip address (- this is also what I will mean by "anonymizing" in ...
0
votes
1answer
530 views

JUNIPER Junos Pulse - how to apply policy to device

We'd like to set up and use Juniper Junos Pulse on iphone and ipad for access to Corporate mail. We have juniper SA and have prepared the policy, but how do we apply the policy to the devices?
1
vote
1answer
96 views

What was the purpose of this attack if one took place?

Background Windows 7 Home Edition HP desktop (no av/no firewall/ remote assistance enabled) two external drives attached/no documents on internal drive connected to fios wifi (wep ...
1
vote
2answers
158 views

Router or Switch can defend against ARP spoofing attack?

I'm learning about ARP spoofing attacks. Can a router or switch defend against ARP attacks?
2
votes
2answers
98 views

Locate server by latency it has to other servers

I just thought about how one can locate a server he has administrative privileges on. My "best" idea till now is to ping a huge amount of servers and then measure the latency of the host to these ...
2
votes
0answers
87 views

Linux machine continuously transferring data over the network to random servers in china and across the globe [duplicate]

I have been using Linux for about 5 years now but I am not very skilled with the commands to monitor and figure out internal issues. I recently was having trouble with the Internet. My roommates were ...
0
votes
4answers
418 views

How can I use netcat like ping?

How can we use the netcat (nc) to determine whether a particular machine is running web, mail or SSH services?
3
votes
3answers
111 views

Detect trojan/keylogger/virus on a businees network

On a business computer network with around 50 computers, there is a computer infected. We need to find that and remove it. I have been running the software below in the suspicious computers, but ...
1
vote
1answer
114 views

Must an attacker using a Smurf attack be on the same network as the victim?

I'm learning about Smurf Attacks. Since they need to use a broadcast address, doesn't that mean they can't work over the internet? For example if an attacker sends a router the packet with the ...
1
vote
0answers
39 views

What kinds of features are useful for network security visualization? [closed]

I just want to know is network security visualization are practical for enterprise network administrators? (Which I am not) And if it is what kind of tools they uses and what kind of features they are ...
18
votes
2answers
1k views

In what scenarios is relying on source IP address as a security control acceptable/unacceptable?

A number of questions on this site mention relying on source IP address as a control and in most of them it is dismissed as being unreliable. In what circumstances might using source IP address as a ...
7
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
8
votes
2answers
417 views

How to secure a modem/ wifi router without login?

A friend of mine has a DSL-modem/wifi-router from his ISP. The configuration page of the modem requires no login and no login can be set. It is said that there also exists a superuser but this is only ...
6
votes
2answers
372 views

Can network admin detect port scan on a certain host?

Say, my laptop is connected to a large WiFi network with many other users. If a port scan is run on my IP by somebody else on the same WiFi network, is it possible for the network admin (or anybody) ...
5
votes
0answers
281 views

Ethical Hacking Certification (CEH v9) From A Web Developer's Perspective [closed]

I just finished a week of training for the CEH v9 certification. I have two questions: What are some strategies I can take for studying for the CEH v9 certification coming at the test as a web ...
1
vote
1answer
35 views

How do these techniques work for protecting against SYN flood?

I'm reading about how SYN flood can be prevented. Wikipedia has Filtering Increasing Backlog Reducing SYN-RECEIVED Timer Recycling the Oldest Half-Open TCP SYN Cache SYN cookies Hybrid Approaches ...
1
vote
1answer
66 views

Shared Global Blacklist Trust Issue

Some vendors like Palo Alto Networks make appliances that will sync blacklists across all of their client base when one of their clients gets attacked. So after the first guy gets attacked, all of the ...
0
votes
2answers
553 views

How do I map all active wireless devices inbound?

In any residential building, there is a multitude of WPA2-protected wireless access points. Yesterday I was at a friend's and attempted to launch aircrack-ng against their AP (with permission). I ...
4
votes
2answers
131 views

Network UTM firewalls, are they really worth it?

I am currently looking at boosting the network security in my organization. (Currently we just use really basic small business network firewalls we primarily bought for IPSec VPNs). However, from ...
3
votes
3answers
381 views

Can one Bypass a Web Proxy by using the Host File?

a website aaa.com has a Static Public IP address x.x.x.x . Client B resides in a network and it accesses the internet through a web proxy C. How the web requests are routed from B to the proxy is ...
42
votes
3answers
4k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
1
vote
2answers
270 views

Spoofing TCP/IP stack OS Fingerprinting attacks in OSX

We need to change our OSX fingerprint in order to impersonate the Android OS against "passive OS fingerprinting" attacks. For Windows machines there are tools/guides for doing that, but can't find ...
3
votes
4answers
3k views

When does one require netbios?

I've heard others talk of disabling netbios, but over the years I have never understood exactly when this protocol is required. The wikipedia page explains very abstractly what it is, but not which ...
3
votes
1answer
220 views

Automating NIKTO scanner

I am working on NIKTO automation. I have a text file contains list of IP addresses along with their ports open. I have already made nikto script. Script functionality - it takes IP addresses and then ...
0
votes
3answers
216 views

What information can my network admin see when I visit a website? [duplicate]

This question is similar to this but for my network admin. For example, when I enter this URL: https://www.google.com/search?q=example or ... I can see the word example that I was searching on ...
2
votes
1answer
210 views

How to configure Kismet to redetect same BSSIDs in a loop?

So I am working on a tool to detect any wifi device using Kismet. When I use Kismet, it works fine, but my problem is, it detects a device once, and until the MAC changes, it wont detect it again. ...
4
votes
2answers
548 views

Possible to detect an/or shut off CryptoLocker by limiting total network bytes transferred?

Since a virus infected PC has to download (encrypt) reupload the entire file (to a file server), and repeat the process for every network drive, is is possible to detect this unusually high bandwidth ...
3
votes
1answer
64 views

How to make Snort not log sensitive data from the sniffed traffic?

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on ...
4
votes
2answers
123 views

Can single-purpose PCs be useful as a security measure in this situation?

In the context of a small scale operation, we are considering use of single special purpose PCs allocated to single security-sensitive tasks - for example, certain financial operations. The intended ...
2
votes
2answers
127 views

4 Hackers on my network! [closed]

Called microsoft hotline because my ASUS laptop got an unknown virus. It would not allow me to access network until i call. The agent i talked to assisted me through the phone. He was able to control ...
0
votes
1answer
53 views

Network security question (NLB and 2-way TLS) [duplicate]

I have a situation that can be better illustrated in the network diagram below. My scenario: Client Web Server (external party) is using TLS 1.2. In my network, My Web Server is fronted by a NLB ...
4
votes
3answers
917 views

Is it possible to sniff traffic of a remote network? (With admin access to router)

Me and a friend of mine are simulating a widespread scenario where router configurations are untouched (default passwords) and are visible from the internet. Him, acting as the victim, will constantly ...
29
votes
2answers
112k views

What is the real function and use of a DMZ on a network?

I read the article on Wikipedia describing what a DMZ (demilitarized zone) is on a network, but am still failing to grasp both how it is set up (ie: is it within the main network or sequestered away?) ...
1
vote
2answers
157 views

Can bad guys record phone conversations without the carrier's knowledge?

I know that, in most of the world, phone conversations are transmitted as digital data (whether frames in circuit switched protocols or packets). I know that several companies offer products which ...
1
vote
1answer
46 views

Between point to point connectivity and remote network access, which is riskier?

Between point to point connectivity and remote network access, which is riskier? If I have a third party accessing my company's network, which are the different modes through which they can access and ...
2
votes
0answers
54 views

Determining time it would take to exhaust IVs on 802.11b/g/n

I'm trying to learn about WEP attacks at the moment. I know that attacks against WEP require collisions of the initialization vectors. Is there a way to determine how long it would take for the ...
4
votes
3answers
1k views

Reveal the True IP of a User

Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection? I.e.: To be able to uncover the true IP from transparent as well as ...
-1
votes
2answers
160 views

How to limit source port for accessing blocked website?

My country has a firewall which blocks sites like Facebook, whatsApp etc. However, they use some kind of port blocking, so some important websites for me like Chegg is also getting blocked I think due ...
0
votes
0answers
916 views

BRCM-LVG in home network

Shortly after the local cable provider upgraded our cable modem an item named BRCM-LVG appeared in the list of devices (two computers) connected to our Windows 7 homegroup. It contains a folder named ...
25
votes
10answers
6k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
0
votes
0answers
45 views

Secured router bridged with a less secure router

I have a router provided by my ISP physically connected to the internet access point. It has basic security (WPA2-PSK) and broadcasts its SSID. I have a second router bridged wirelessly to the first ...