Network Security - securing network infrastructure and connections
2
votes
2answers
418 views
Restrict network access for a single process with SELinux or AppArmor
I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
4
votes
1answer
137 views
How does my antivirus determine which CTL is used?
I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
6
votes
8answers
429 views
Should I block visitors who seem to be probing my site?
I have detected some attempts to probe the security of my site. Should I blacklist their IP address? What are the considerations or tradeoffs to use in deciding when to block their IP address and ...
2
votes
2answers
145 views
Is this enough for an NIDS
I am doing my senior project on network intrusion detection system (ethernet networks) and I am having a bit of trouble deciding if I have added enough features.
Currently the system detects the ...
6
votes
1answer
214 views
What are the security measures taken on GPS transmissions?
I was just reading this article on how phone GPS work and the improvements that Apple had done to reduce the amount of time those calculations take on a regular iPhone.
That makes me wonder: what ...
2
votes
7answers
469 views
Tracking unique web site visits without logging IP addresses
On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it.
On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it.
If the two IP addresses are equal, I throw out the ...
3
votes
1answer
227 views
How to do layer 3 VLAN hopping?
I am connected to 3 layer switch used to create IP subnet-based VLANs. Is there any way to do VLAN hopping? Note that this isn't using 802.1q; it's not port-based L2.
1
vote
1answer
192 views
wireless: Jamming or interference? [closed]
I'm currently in a hotel trying to access the internet through the wireless offered by the hotel. WPA2-Personal network, password consisting of 16 numbers. Connecting to the wireless works fine, ...
1
vote
1answer
165 views
Can I bypass my own networked camera?
We have networked camera on my house. My brother is protected by user name and password. When I check my network in laptop, I can see the networked camera in my network but when I click to open, it ...
0
votes
3answers
277 views
Is it possible to “close” a port by dos'ing it?
If I see port 25 is open, but I dont have access to the program running the smtp server, could It be flooded with enough information to make it unusable (but not affect any other services)?
3
votes
2answers
243 views
How effective is changing the MAC address?
Since every vendor has a MAC address range, and Apple has network card models that only they use (Airport), I suppose that it is very easy to identify a network package as coming from an Apple device, ...
4
votes
2answers
840 views
Does Java applets reveal the real IP address, even when using proxy or vpn?
Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
1
vote
0answers
64 views
Distinct databases with the same Kerberos Authentication server
Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)?
Or is ...
5
votes
2answers
572 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
19
votes
5answers
941 views
Is having Steam installed a security risk?
Speaking to one of our security administrators at work, he insists that Steam is a well understood security risk and it shouldn't be installed on work machines.
Saying it's not work related I ...
10
votes
4answers
1k views
How can mini-computers (like Raspberry Pi) be applied to IT security?
It's no secret that thousands of $35 Raspberry Pi (Model B) computers have just shipped to people around the world. With these, and other similar types of computers becoming cheaper and more ...
0
votes
1answer
644 views
Monitor incoming TCP/UDP flood attack and graph it
I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results.
I have some VPSes that will perform a ...
2
votes
2answers
2k views
IPTables DDoS protection working with per client IP address counter AND UDP
I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain.
...
1
vote
4answers
292 views
How password hashing is useful in MITM attack?
Even though I read a lot about hashing and how passwords are protected, I am still confused about it.
If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
0
votes
2answers
177 views
How to securely set up wifi? [duplicate]
Possible Duplicate:
How to secure a WiFi network?
It seems like a simple question but I've thought about this for a while and have done quite a bit of Google searching. There's a LOT of ...
2
votes
2answers
381 views
PCI Compliance network scope
I was wondering if anyone could clarify the scope of PCI compliance with regard to multiple networks.
At present, there's one PCI compliant network to which another network connects via VPN. The PCI ...
5
votes
1answer
250 views
How do you analyze an unknown network protocol?
Of course Wireshark can be used to sniff traffic - you can inspect each packet or chain of packets.
But how would you do it smarter? Which tools do you use to identify behaviors or to automate the ...
3
votes
4answers
3k views
What are the laws regarding ISP recording IP addresses? How would they know who had which?
Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
2
votes
2answers
382 views
how to identify p2p on network
Im trying to work out if the traffic in the below image is P2P file sharing?
If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
0
votes
3answers
600 views
How to setup an internal firewall
I'm hoping to get some advice on a project I've been asked to look after at work. I do all of the IT for a small company that sits inside of a larger corporation. We need to prevent access to ...
1
vote
2answers
484 views
SUN Remote Procedure Call Port 111 [closed]
I have found on my machine port 111 is open. This is listed as RPC.
I understand there are possible attacks on this port. How can my machine be attacked if port 111 is open?
How can I secure this ...
5
votes
2answers
897 views
Need help identifying the OSX process that's generating strange network traffic
Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like:
Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
1
vote
1answer
259 views
What torrent software should I be aware of as a security professional? [closed]
I am new to the torrent world and want to experiment / learn with the lowest risk possible.
What do I need to know about torrent software, and related software and network configuration in order to ...
1
vote
2answers
126 views
I want to remove my WAP access list
Background:
Fabrication of data is a high security concern
Interception of (most) data is a low security concern
Destruction of data is a medium security concern (everything is backed up, but ...
1
vote
1answer
409 views
How to fix the audit failure in our web server
We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.
Can anybody help me how to isolate and prevent this from happening?
An ...
3
votes
5answers
833 views
Can voice chat be spied?
I wonder if voice chat (via public services like yahoo, google talk, skype, etc) is practically secure? Is it possible for the ISP or any middle point? I do not consider hacking the computers, but ...
6
votes
1answer
974 views
Backtrack 5 in a VM - Why bridged networking over NAT?
When running Backtrack 5 from a VM, it is recommended to use the bridged networking option instead of the NAT networking option? How does it affect the usage of Backtrack - port scanning, ...
4
votes
3answers
510 views
Is there any risk in allowing ping packets *out* through a firewall
The company I'm currently doing work for does not allow ping requests out through their firewall, for "security reasons" and I'm baffled as to why this is a concern.
Before you point me to (e.g.) ...
3
votes
7answers
387 views
Scanning A Subnet Externaly
Scenario:
I have a router with a public IP address provided by the ISP and two hosts behind the router with a private IP (192.168.x.x).
Is it possible to perform a port or vulnerability scan of a ...
2
votes
1answer
469 views
Analyzing wireshark results (openvpn)
I signed up to Mullvad for VPN service, and manually run OpenVPN from my Linux box.
I rebooted my computer and make sure not to start any OpenVPN service. Yet when I did a Wireshark analysis I am ...
4
votes
1answer
253 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
0
votes
0answers
228 views
Pcap file inspection [closed]
I have 3 packet capture, generated with Wireshark, of an example intrusion but I'm struggling to figure out whats going on.
I also tried running the pcap files in snort to see if it detected ...
4
votes
3answers
2k views
How can I trace the IP address of person in chat?
Is it possible to trace my IP address when I am chatting with others (with gtalk or Facebook)? If so, how could someone do that?
3
votes
2answers
83 views
Evaluating hosting providers for CC development environment
An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
4
votes
2answers
136 views
Should you label networking equipment? is this a security risk?
Should you label networking equipment? is this a security risk? if we label all the networking devices within our company with its host names are we potentially giving away info that we should not?
...
2
votes
3answers
140 views
Secure device pairing protocol
I need to implement secure pairing between two devices based on a short shared PIN code with no trusted third party. If you think about the way bluetooth devices pair you won't be far off -- my ...
1
vote
3answers
806 views
MITM: tools for intercepting and modifying traffic?
I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request.
For example:
When I receive a request on port 25, I want to be able to intercept all the ...
2
votes
2answers
141 views
ASLR in Ubuntu 11.10
In many of the exploits I see nowadays, brute forcing is a common method of bypassing ASLR on 32 bit machines. However, many of these exploits crash the current process, for example, PHP. Isn't the ...
1
vote
2answers
236 views
Can a TCP connection with a VM be “escaped from” to reach the host? [duplicate]
Possible Duplicate:
How secure are virtual machines really? False sense of security?
If a VM (e.g. VirtualBox) on host A opens a TCP connection to a hacker Z, are there any possible ...
4
votes
3answers
3k views
Is NAT Loopback on my router a security problem?
Some DSL routers prevent NAT loopback. Security is sometimes cited as the reason. Is NAT loopback really a security issue? And if so, how is this exploited?
NAT loopback... where a machine on the LAN ...
0
votes
1answer
292 views
What kind of network tapping/sniffing hardware can be used to install NIDS or examine networks? [closed]
I'm looking for a device that can be plugged in between a client computer and a switch and records all ethernet packets and puts it into a pcap file or similar in order to analyse it with wireshark.
...
1
vote
2answers
168 views
Securing a VPN connection
I'm new to this
we want to install a new VPN connection that will be used to connect using Internet to some networks in the office
the contractor want to use a" Cisco NAC Network Module or Cisco IPS ...
4
votes
4answers
292 views
Malware that uses http as a covert channel
I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour.
Is there any database of malware, ...
1
vote
4answers
202 views
Learn about network and security for securing a server
I'm setting up an OpenBSD server that I want to connect to the Internet (it's going to be used to host a site - so, with Apache, SQLite and the like).
I want it to be as secure as possible. Social ...
0
votes
3answers
283 views
Proxy Server options for school administrators [closed]
I want to set up a proxy server for a school to prevent users to log-in to site like Facebook, Youtube, etc.
I have no idea how to do this, so I´d really appreciate your help.
