Network Security - securing network infrastructure and connections
1
vote
3answers
938 views
How to set password on applications in Mac OS to prevent an administrator to start them?
Is there any program that can set password on the app like mail or browser? I know about parent control, but I doesn't work with administrator account.
What I want is some program that blocks some ...
2
votes
3answers
440 views
How can I make it more difficult for a user to create multiple accounts?
I would like to know the best way to increase security on a website so that the a single user can't create multiple accounts.
What all of a user can be traced? I'm thinking:
IP address
Mac address
...
4
votes
2answers
671 views
Fuzzing with SPIKE - the \r\n not being taken into account
I would like to fuzz FTP protocol, and currently I have the following:
s_read_packet();
s_string("USER test\r\n");
s_read_packet();
s_string("PASS test\r\n");
s_read_packet();
I've also tried ...
2
votes
2answers
456 views
Is traffic sent by Mouse Without Borders encrypted?
Some of our users have installed Mouse Without Borders and I wanted to know if it is possible to intercept the traffic being sent between the two computers and read it in some meaningful manner. I was ...
0
votes
1answer
2k views
In Metasploit, how to use a custom exe as payload?
Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
4
votes
3answers
3k views
What do the UDP entries in my netstat output stand for?
I ran netstat -a under windows.
what is the meaning of this line UDP [::]:57427 *:* ?
Proto Local Address Foreign Address State
UDP [::]:5355 *:*
UDP ...
3
votes
2answers
311 views
1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab
I bought a bunch of cisco equipment for a project and I got
1 PIX firewall
2 switches
and 2 routers
This is my plan for a topology but I am new at this so I need help.
I am basing this off the ...
12
votes
10answers
8k views
Public DMZ network architecture
Years ago, when I was a student, a network security professor taught me in a class what a DMZ is. The architecture he used in his slides was similar to this one:
Now that I got employed, my boss, a ...
2
votes
1answer
90 views
Network abnormally slow during night hours
My network recently the last week as become abnormally slow around 11 pm. Very slow buffering youtube videos during all hours. Ive recently purchased the new router about two months ago but not ...
2
votes
2answers
148 views
network improvements over ipsec
I have a specific environment in which TCP is not optimal due to its general assumptions, and thus needs to be improved. This small improvement has been done successfully. It operates at various ...
3
votes
6answers
2k views
monitoring outgoing network traffic
The graphs for one server that I am using are showing consistent 7.5 kb/s outgoing network traffic that started a few days ago.
How can I monitor/log/capture/analize this traffic to see what is it,
...
2
votes
2answers
194 views
Project help required by a newbie!
Basically, I'm doing a degree in network computing and am currently working on my dissertation right now. I am not an expert with networking yet, so I'm kind of struggling to get started with my topic ...
2
votes
2answers
423 views
Reveal the True IP of a User
Is there any best practice method (and preferably documented) way of revealing the True IP of a user using a HTTP(S) connection?
I.e.: To be able to uncover the true IP from transparent as well as ...
3
votes
1answer
2k views
VirtualBox Pen Test Lab Setup
So i'm trying to set up a pen test lab in virtual box on my windows 7 host.
I have 3 guest OS's installed:
1.) BackTrack5
2.) Centos 5 Server/Snort (My Snortbox)
3.) Win XP (Unpatched)
I have 3 ...
1
vote
1answer
211 views
How can wireless router password encrypts data using WEP and WPA
How does the password that we enter (to connect to a wireless network) encrypt the data on the wireless network?
Through my reading I am not sure if the password that we enter is the same as the ...
1
vote
1answer
214 views
Does signing my e-mail with DKIM imply non-repudiation for all my users?
Since a few weeks I have set up my google apps domain to use DKIM for all outgoing mail. Does this mean that everyone that is in possession of a copy of the message can verify that it really ...
2
votes
1answer
192 views
Stateful Signatures in an IPS
I am researching IPS devices and their signatures both stateful and stateless. The test network I am looking to implement the IPS in has asymmetric traffic so stateful inspection would be nearly ...
0
votes
1answer
92 views
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
0
votes
1answer
2k views
If a router has port 5060 open, and I know that there is unencrypted SIP traffic going through this port, how could one take advantage of this
Ok so an Nmap scan against an IP address shows that port 5060 is open. I know that 5060 indicates that this is SIP traffic. Also, 5060 indiciates that this is unencrypted traffic, where if the port ...
0
votes
2answers
240 views
Unexplained downloading
I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark.
The ...
-3
votes
2answers
670 views
Could somebody explain the basics of Wireshark to me [closed]
I've downloaded Wireshark, messed around with the GUI a bit and, honestly, I can't make head nor tail of what I am looking at.
I understand that Winpcap allows me to create a copy of every packet ...
5
votes
2answers
1k views
Is opening port 3389 on a router and forwarding this to a Windows SBS 2003 server secure?
I know of a company who has port 3389 open on their router and forwards this to a Windows SBS 2003 server. The server has the Windows firewall switched on, is patched and has an up to date antivirus ...
4
votes
5answers
1k views
Is it trivial to bypass IP blocking?
There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked.
I've heard about IP spoofing and similar attacks. ...
1
vote
2answers
146 views
Recently set up a server, Need security help
I set up a server running debian I opened port 22 allowing access to ssh into the port. I keep getting weird messages in my router log saying: [LAN access from remote] from 211.161.46.101:57201 to ...
4
votes
4answers
762 views
Block all BotNets and TOR addresses from accessing our site
I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
0
votes
3answers
669 views
Weird mac address on router
I found a weird mac address connected to my home router. How would I figure out what os the IP or mac address is running.
1
vote
2answers
734 views
Is CIFS/SMB (Folder Sharing in Windows) secure?
I have to back up some data from windows 7 machines over the internet, and I rarely use windows so am distrustful of it in general. Specifically:
Is there any sort of check that the server is the ...
5
votes
2answers
791 views
Is IP spoofing relevant to TCP? Is it relevant for TLS or SSH?
I have read the TCP Connection Establishment on Wikipedia
In brief the packets to start are
SYN, with a (hopefully) random sequence number A from the client.
SYN-ACK, responding, with A+1 and ...
10
votes
8answers
1k views
Can IP address be a component of 2-factor authentication?
I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
4
votes
4answers
1k views
Using SYN cookies to perform a DOS attack
In my software security class, we had this question:
You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
1
vote
3answers
118 views
How to reverse the communication for security
I have the following use case - There are two networks - internal network where the application server is deployed and has no internet access and external network that is accessible from internet but ...
0
votes
0answers
225 views
Using more multiple VPN client's to connect to the same CISCO ASA VPN client connection [closed]
I am currently using CISCO VPN client in a Read Hat Linux machine to connect to a CISCO ASA.
I am planing to connect another LINUX maching to the same ASA using the CISCO VPN client.
Does any ...
6
votes
1answer
210 views
Epson Projector security threats
I have an EPSON PROJECTOR (model EB-824H)
And I would like to use it in our company.
As I know (but not sure) this kind of projector has no WIFI,no network card and there is no HD in this PROJECTOR
It ...
1
vote
1answer
330 views
Open source firewall with multi wan support [closed]
I use smoothwall express and also used IPCop. But now I need to have multi WAN support as I want to use a DSL and Cable internet connection together to increase my speed, specifically upload speed.
...
4
votes
3answers
334 views
Why does switching to “n-only” help preventing attacks on WPS?
I just cracked the ap of a friend of mine (Linksys E4200) and we were looking for a way to rid him of the vulnerabilty. Unfortunately the E4200 does not disable WPS when you tell it to (via web gui).
...
3
votes
1answer
99 views
What project is a good SILC substitute?
As time has marched on, it would appear that the Secure Internet Live Conferencing (SILC) client/toolkit have lost a bit of steam, I can't find any current mailing lists, their website doesn't seem to ...
4
votes
3answers
1k views
Why do I need a firewall on my router?
I just bought a new router, and as usual the router manufacturer make a big deal out of the firewall.
I have never understood why the firewall is needed, sure, stopping dos attacks (such as ...
5
votes
2answers
2k views
Detecting the presence of wifi devices
Is it possible, with a normal wifi adapter, to detect present wifi devices in the surrounding? Let's say, is it possible to detect an Iphone with wifi switched on in the range of my wifi adapter?
...
2
votes
2answers
3k views
What are these ip adresses my computer is connected and how do I block them if they are malicious? [closed]
When I execute a netstat command i see several ip-adresses that have connection to my pc and I don't what they are for. These are the ip's.
TCP 192.168.1.20:1042 fa-in-f125:5222 ...
13
votes
7answers
13k views
How secure is TeamViewer for simple remote support?
I'm deploying a web-based ERP system for a customer, such that both the server and the client machines will be inside the customer's intranet. I was advised in another question not to use TeamViewer ...
4
votes
2answers
173 views
Remotely fingerprint AV software on LAN machines?
Does anyone know of a method to fingerprint machines in the LAN and find out what kind of AV software is installed?
12
votes
6answers
2k views
Can I detect a MITM attack?
Based on this question here:
Are "man in the middle" attacks extremely rare?
Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it?
In addition, what if ...
96
votes
8answers
8k views
Are “man in the middle” attacks extremely rare?
In
http://cdixon.org/2012/02/12/the-iphone-contact-list-controversy-and-app-security/
Chris Dixon makes a statement about web security
Many commentators have suggested that a primary security ...
3
votes
2answers
173 views
VPN Appliance Placement Options
I'm currently looking to implement a VPN solution (based on a Checkpoint Connectra) purely to provide remote access to staff (no site-to-site, or customer access), but the one design decision I can't ...
3
votes
2answers
407 views
The point of PCI 1.3.1 through 1.3.3
In expansion to my previous question what qualifies as public access? I'm trying to wrap my head around the intent of the points 1.3.1 and 1.3.2 and 1.3.3 of the PCI standard.
I have four DMZs at my ...
6
votes
5answers
406 views
“There's a firewall on the router into the building so you can turn the one on your computer off”
I know some people that, in regards to network security, argue that because the firewall on the router into the building is on, that makes the network secure and therefore, the firewall on Windows ...
3
votes
1answer
210 views
Could somebody explain connect loop DoS?
I'm trying to understand this vulnerability.
How can I reproduce this?
3
votes
5answers
243 views
Securing data transfer between public network and personal accounts
I would be traveling soon and I am looking for all kinds of ways to encrypt the data transfer (usernames, passwords, emails ...) between the new networks to which I will connect my Laptop, that is ...
2
votes
1answer
770 views
w00tw00t.at.ISC.SANS.DFind iptables fix - abusable?
It's only an idea. I've recently logged that my server is scanned by w00tw00t tools.
I found many solutions to this, such as use of apache mod-security, fail2ban, etc..
The one I want to speak ...
2
votes
1answer
531 views
How do I protect my Windows computer against the IPV6 flood attack shown in this video
In the DefCon video "Three Generations of DoS Attacks (with Audience Participation, as Victims)", the speaker demonstrates how it is possible to crash a variety of devices by flooding them with IPV6 ...
