Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

6
votes
1answer
290 views

Epson Projector security threats

I have an EPSON PROJECTOR (model EB-824H) And I would like to use it in our company. As I know (but not sure) this kind of projector has no WIFI,no network card and there is no HD in this PROJECTOR It ...
6
votes
2answers
2k views

Strange STP traffic in my network, possible MitM attack?

I live at a student dorm, where we are connected to a student network. The administrators of this network have forgotten to disable STP broadcast on non-infrastructure ports. Periodically, I lose my ...
6
votes
3answers
551 views

wlan security - why is it not possible to protect against deauthentication flooding

Wireless security (Wikipedia) describes security issues due to the fact that wi-fi deauthentication packets are unencrypted: Weak PSK passphrases can be broken using off-line dictionary attacks by ...
6
votes
2answers
572 views

SSH Tunnelling: How can I stop users being able to access services bound to localhost via port forwarding?

I want to be able to offer ssh accounts on my linux server for people to be able to use for SSH tunnelling. All accounts will be locked down with no interactive shell, for tunnelling / port forwarding ...
6
votes
3answers
2k views

Can I block the true IP address using X-Forwarded-For header in IIS?

All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address. Can I use the X-Forwarded-For header with ...
6
votes
1answer
971 views

Deploying a campus WiFi network that authenticates against an AD LDAP

We are looking to deploy about 15-20 Cisco 1131ag access points on campus. I have been reading up on different authentication methods, but I don’t know what will be the best long term solution that ...
6
votes
1answer
670 views

How to get hold of and use WPA session keys?

I'm testing sniffing and decrypting my WPA2 wifi network traffic. But when using airdecap to decrypt the capture file (created by airodump) using my WPA passphrase I only get broadcast traffic. If I ...
6
votes
4answers
551 views

Has my network/computer been breached?

I'm not sure if this is the right site to ask, so I apologise if it isn't, but here goes. A while ago I started noticing some odd behaviour. My Gmail account was compromised, it seemed, and I had to ...
6
votes
1answer
3k views

Obtain credentials by spoofing WPA/WPA2 Enterprise network?

I have a large scale wireless network secured using WPA/WPA2 Enterprise authentication. Recently, I was made aware of the possibility that someone may use a dd-wrt router and a computer to spoof the ...
6
votes
1answer
2k views

How to create your own RBL DNS Blacklist to prevent spam

I am getting sick of reporting the same old chinese emails to Spamcop now and would like to make my own small RBL list that I can easily add blocks of IP's to. I have a spare PC and static IP address ...
6
votes
2answers
145 views

Are temporary blocks sufficient response to network probes?

We have the option of using an automatic blocking feature of our firewall to temporarily block the source IPs of network probes. It is fast and automatic, and it expires after a set amount of time. ...
6
votes
1answer
705 views

I can receive all PADI packets for PPPoE connections of my ISP, is that a problem?

for debugging why my router wasn't connecting to pppoe i've tried to connect via the pc, it worked, then i started wireshark just to see what was going on, and i've seen that i can read all the PADI ...
6
votes
2answers
7k views

What is best practice for separation of trusted zones from a DMZ with a single firewall?

At our organization we have a single firewall sitting between our internal zones and the public internet. Currently all of our trusted zones are defined as different vlans on a layer 3 switch plugged ...
5
votes
3answers
6k views

How can I keep a roommate from seeing my web activity?

I have a roommate who is a network security engineer and I think he hacked our home network and now knows what sites I am visiting and what I am doing online. Although he is not stealing anything I ...
5
votes
5answers
1k views

Is there a reason to disable root login, if SSH connections are restricted to a single IPv4 address?

I have a linux server running centos, and while hardending the SSH server, I asked myself: Is there a reason to disable root login, when only I (assuming my IP address is static, and i have direct ...
5
votes
4answers
660 views

What is War Dialing?

The topic says it all - I encountered the term in a PDF given to me. So ... what does the term/phrase 'War Dialing' mean?
5
votes
4answers
17k views

Tips for a secure iptables config to defend from attacks. (client side!)

Own examples: ############### # KERNEL PARAMETER CONFIGURATION # PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # DROP ICMP ECHO-REQUEST ...
5
votes
8answers
12k views

How to block some websites and torrent usage in a small office?

In my office there are approaximately 25 systems are connected through network and all having internet accessibility.but some people are missusing this facilities like downloading films from torrent ...
5
votes
3answers
3k views

Resolving an IP address of a Remote machine to its MAC address

I wanted to know whether its possible to get the MAC address of remote node (computer/Access Point) if I know its IP address. I have heard that if someone sends you an email (even through gmail), you ...
5
votes
7answers
1k views

What security risks exist in cell phone apps' data transfer?

Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not ...
5
votes
4answers
167 views

software to keep a list of IP that try to access ssh over a set of rules and feasibility

i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like: one attempt to log as ...
5
votes
4answers
4k views

Prevent network users from creating an unauthorized outgoing VPN connection to avoid network policies

Is it possible to prevent network users from creating unauthorized outgoing VPN connections to avoid network policies? Edit- What is the best way to detect unauthorized outgoing VPN connections while ...
5
votes
1answer
709 views

What is the value of encrypting a payload when it will be transferred over sftp anyway?

We have a integration arrangement to send content across the internet and the agreed protocol encrypts then sends it via sftp. What possible reason coould there be to encrypt the content twice? I ...
5
votes
5answers
440 views

Can hardware firewalls be infected?

If a computer is directly connected to the internet, it is vulnerable to attacks. So we attach a hardware firewall between the computer and the internet. But doesn't this new setup mean that now our ...
5
votes
5answers
447 views

Is there a way to identify the host of a malicious VM from across the network?

Scenario: Someone is attacking your network. However, they're not exactly using their machine to do it - they're using a VM running on their system. The VM's network adapter is configured in ...
5
votes
4answers
1k views

Ways to monitor someone's internet traffic

If some authority for whatever reason decides they want to monitor your traffic on a wired DSL connection, how would they do it besides exploiting your OS? What are the other ways assuming the OS is ...
5
votes
2answers
11k views

What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market

I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff. So I ...
5
votes
4answers
1k views

Email header IP address

Do the IP addresses in an email header include information from the device from which the mail is being sent, or from the mail server?
5
votes
4answers
731 views

Persisting and comparing NMAP scans

Does anyone have any good recommendations on a good tool for persisting NMAP scans to database? It may be a tool for persisting or simply a java library for easy parsing of the nmap xml scan result ...
5
votes
3answers
4k views

Why do I need a firewall on my router?

I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall. I have never understood why the firewall is needed, sure, stopping dos attacks (such as ...
5
votes
1answer
6k views

Are open ports dangerous?

I have forwarded port 80 to WAMPServer and 25565 to the MineCraft-server running Bukkit. (http://www.bukkit.org/) Am I vulnerable to attacks. Can hackers attack me if WAMP-server is running or if it ...
5
votes
3answers
633 views

Books on Cryptography, with a focus on application to Network Security?

Looking for some nice text books in the field of network security as part of my course. Our course covers mainly tls, ssl, pgp, smime, vpn, md5, hmac ....
5
votes
2answers
1k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
5
votes
2answers
2k views

Is opening port 3389 on a router and forwarding this to a Windows SBS 2003 server secure?

I know of a company who has port 3389 open on their router and forwards this to a Windows SBS 2003 server. The server has the Windows firewall switched on, is patched and has an up to date antivirus ...
5
votes
2answers
7k views

Detecting the presence of wifi devices

Is it possible, with a normal wifi adapter, to detect present wifi devices in the surrounding? Let's say, is it possible to detect an Iphone with wifi switched on in the range of my wifi adapter? ...
5
votes
2answers
740 views

Is that possible? A router with arpspoof from factory

Just bought a 3G router from China and then checked the log: [1970-01-01 00:00:00] The system will be restored the factory value. [1970-01-01 00:00:00] The system current version: 1.0.5.1. ...
5
votes
3answers
424 views

Solaris: IP Spoofing Across Ethernet Ports

Given a Solaris machine with two network interfaces corresponding to the separate ethernet ports in the back. 0: 192.168.0.5/255.255.255.0 1: 192.168.1.5/255.255.255.0 with /etc/defaultrouter set ...
5
votes
1answer
404 views

How do you analyze an unknown network protocol?

Of course Wireshark can be used to sniff traffic - you can inspect each packet or chain of packets. But how would you do it smarter? Which tools do you use to identify behaviors or to automate the ...
5
votes
1answer
893 views

TLS at layer 4 BUT 802.1X EAP-TLS at layer 2?

In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine. Port security 802.1X and EAP is a data link layer 2 ...
5
votes
2answers
279 views

How did Evernote detect the security breach?

http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ Evernote's official message says little about technical details of the attack and how it was detected. ...
5
votes
3answers
2k views

What makes the Blackberry device and network more secure?

One of Blackberry's strongest assets is the "network" that it uses. Can someone explain, or link to technical information that covers what this secure network is, and what it does better than the ...
5
votes
2answers
1k views

How eavesdropping will be performed how can I prevent from eavesdropping

I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that ...
5
votes
3answers
621 views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
5
votes
3answers
391 views

How did the spammers get this address?

A few months ago I configured a test mail server on Amazon AWS, all legit. I used a new address to my catchall-domain (something similar to, but not exactly, ...
5
votes
3answers
306 views

Organization like OWASP for network security?

Is there something like OWASP for Network Security ? Or have anyone of you come across a testing guide for network security, as to how to start an audit and then the minimum number of tests to run ...
5
votes
2answers
2k views

Need help identifying the OSX process that's generating strange network traffic

Since the past few days, I noticed that my router was a bit slow, and was restarting by itself at times. When looked at it's logs, they had entries like: Friday Jul 13 13:09:02 2012 1 Blocked by DoS ...
5
votes
4answers
2k views

Two SSIDs on same Access point- not good?

If I were to offer two networks (one for trusted users and one to visitors) on one physical access point, is this dangerous because a visitor could compromise the trusted network across via the ...
5
votes
1answer
724 views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
1answer
476 views

Reasons behind MAC Spoofing on a corporate network?

My team is inspecting some MAC Spoofing events that are triggering in our corporate environment. After talking it over with the team, this is the information that we have that is relevant.... The ...
5
votes
2answers
740 views

How can I use nmap to distinguish between a normal linux machine and an android device?

According to this link: here, nmap 5.2 onwards is now supposed to detect android smartphones. I am using nmap 6.01 but it only identifies android devices as running a linux kernel.