Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

3
votes
2answers
211 views

Is this enough for an NIDS

I am doing my senior project on network intrusion detection system (Ethernet networks) and I am having a bit of trouble deciding if I have added enough features. Currently the system detects the ...
1
vote
2answers
131 views

Nmap says host down, but host is up

I am using nmap 7.12 on Mac OS X. I haven’t been able to find a solution to my issue. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP ...
0
votes
0answers
23 views

Identify malicous hosts in our network by sending valid domain credentials

We are currently whitelisting the hosts owned by our company on our Cisco switches to prevent private hosts in our network. This works pretty well but someone can still spoof the MAC address of his ...
8
votes
3answers
331 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
0
votes
1answer
25 views

What does it mean when airodump-ng shows 0 beacons?

I have one particular AP that shows 0 Beacons in airodump. I can see the beacons in all the other AP without a problem. So is it even possible for AP to not send beacon frames?
1
vote
3answers
174 views

Can bad guys record phone conversations without the carrier's knowledge?

I know that, in most of the world, phone conversations are transmitted as digital data (whether frames in circuit switched protocols or packets). I know that several companies offer products which ...
3
votes
2answers
428 views

What prevents this session hijacking from occurring? (SMB/CIFS example)

SMB/CIFS (file sharing, Windows environment) I understand when a client connects to a server there is a challenge/response system in place. However, once the client is connected that "connection" is ...
97
votes
14answers
28k views

How can mom monitor my internet history from a distance?

This might sound like a funny question from a twelve-year-old. The less funny part is that I am 21 and currently studying at university (I don't live at University, although I am 15 minutes away. I do ...
4
votes
1answer
1k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
0
votes
3answers
229 views

Decrypting SSL over a mobile network

I work for a large company and we are trying to judge the safety of some proprietary information that is being sent and received in a new application we are developing. After our initial testing we ...
11
votes
3answers
13k views

How to get MAC addresses of devices which are not in the network

Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux) I have been trying to get the MAC addresses of devices connected to my network through ...
6
votes
3answers
1k views

What is the purpose of subdomain enumeration?

There're a number of security tools out there that enumerate the subdomains of a given domain. I wonder: What's the purpose of that in terms of security / hacking? Is there any way to do that other ...
1
vote
1answer
53 views

How to capture all traffic from a new device?

I have a new IoT type of device that requires a wifi connection to work. I have no use for the device but I'd like to poke around it and learn more about it. How should I go about intercepting every ...
3
votes
2answers
90 views

What are the risks of still using a 1024-bit certificate in a private network?

One of our colleagues ran a Qualys scan on an internally used product and found that the product still uses 1024-bit certificates for its modules to communicate with each other. The vendor says that ...
3
votes
2answers
287 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
1
vote
2answers
55 views

Key-exchange over the network with more than two peers

Me and my team is developing a multiplayer videogame with a Client/Server-Topology. This secures the match from clients who have the intention to cheat because of server authority but still allows the ...
26
votes
5answers
29k views

Can I detect a MITM attack?

Based on this question here: Are "man in the middle" attacks extremely rare? Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it? In addition, what if ...
0
votes
0answers
11 views

Pulledpork not disabling all rules in disablesid.conf [closed]

Every time I run pulled pork, it disables 6 random rules from my disabledsid.conf and leaves the rest alone. I have hundreds of rules in the disablesid.conf and the path is correct. IE: # example ...
2
votes
1answer
50 views

Virtual network for malware analysis

I'm attempting to do some analysis work on a malware sample but I'm running into a wall. I can't get the malware to execute correctly and talk to its C2 server. In my lab I have a Windows machine that ...
2
votes
3answers
27k views

How to know what others browse through the network?

My friend connected to WIFI and after 5 minutes he told me which sites I had actually been browsing, and who I chat with. My question is: how do I defend myself against this, and also how did he do ...
0
votes
0answers
27 views

How do you receive Clone Pool traffic on a Linux IDS server?

we use IDS servers with suricata on a standard Gentoo Linux. One sensor is supposed to process traffic from F5 network devices, and there is a Clone Pool configured. Clone Pools are the recommended ...
3
votes
0answers
34 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
3
votes
1answer
57 views

IP Spoofing between subnets

I'm new PT. In a test I was required to do, I was given a port in the segment of 172.13.x.x. I was asked to test if I'm able to reach a server at 172.16.x.x. I was wondering (considering there's ...
0
votes
1answer
131 views

Is it possible to bypass sniffing when using port mirroring?

INTERNET <-A-> ROUTER <-B-> PC Let's theoretically think we mirror the port on a ROUTER to a file. So the full network traffic on it. Question: is it possible to still have ...
2
votes
3answers
5k views

How to search for evidence of Camfecting (webcam hacking)?

I'm worried about camfecting (webcam hacking). The camera light on my mac (running OSX) is not on, but it isn't hard wired so that doesn't say a lot. I've ran a virus scan but no signs. Now my idea ...
4
votes
2answers
92 views

Set up a system to sandbox/capture outbound traffic from Windows PC?

Does anyone know of a program/system that is purpose built to allow you to sandbox/contain an outbound connection from a Windows PC? The aim being that you can analyse the data being sent via the ...
0
votes
1answer
32 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
1
vote
2answers
18 views

Is running SNMP v2c really insecure and can lead to compromisses?

I currently use SNMP v2c to monitor switches, servers, ect... to graph for performance. Question in terms of SNMP. Everyone says that running SNMP insecure is a security risk. How is a graphing ...
4
votes
1answer
246 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
19
votes
6answers
29k views

Why is WPA Enterprise more secure than WPA2?

In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
0
votes
0answers
48 views

How to view which ports are opened on firewall?

I have a perimeter modem that should have a firewall, but the admin portal does not display much useful info on what settings it has and whether it is on or not. How would you get a list of open ...
0
votes
1answer
127 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
-1
votes
1answer
75 views

Deauthenticate ALL wlan networks/clients in range [closed]

I need to deauthenticate all clients in all networks within the range of my wlan-adapter. Aireplay-ng allows only to focus a single network. Are there any programs or scripts i can use for this ...
2
votes
0answers
17 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
-1
votes
3answers
142 views

Who can spy on my wifi usage and websites I visit?

I'm using a WPA/WPA2 encrypted WiFi. Who can view what I'm doing? Also how? Can the person that pays for the WiFi look up exactly what I am doing (e.g. look up exact messages I've sent on Facebook)?...
44
votes
10answers
52k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
1
vote
1answer
65 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
0
votes
1answer
48 views

Following strategy using DDoS mitigation service - UDP bandwith exhaustion attack from spoofed IPs

I need to defend against receiving a massive spam of UDP packets from random spoofed IP addresses. I would make it this way: In my protocol, every UDP packet contains username and password. Firewall(...
1
vote
2answers
202 views

Kali Linux/Metasploit in VirtualBox - Issue with ports

I've been attempting to get port 4444 to open these past couple of days. I finally figured I'd try to get it working on my Windows machine first and I finally got it. Now, no matter what I do in the ...
0
votes
1answer
142 views

Is it safe to be showing my WAN and LAN IPs in my email headers?

I don't know how to hide my LAN IP from my email recipients. My LAN IP shows up next to my WAN IP in my outgoing email headers (sent to my other accounts and viewed by me). I have not seen emails sent ...
0
votes
1answer
83 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
1
vote
3answers
13k views

Is there any solution for block the HTTPS traffic using URL filtering?

The URL filtering can block the HTTP traffic but not the HTTPS traffic in Internet Explorer. For example, the website http://www.facebook.com is blocked by the URL filtering while the https://www....
76
votes
1answer
9k views

What is this kind of low-intensity, non-hacking attack on a web service?

I am seeing for about 10 days now a bunch of EC2 machines (about 30, distributed in all regions) which are attacking a server of mine. The interesting (or uninteresting, I do not know yet) fact is ...
10
votes
2answers
153 views

Using Single Domain Name to Identify Multiple Servers Improves Security? (Google's use of 1e100.net)

Since 2009, Google has been using a single domain name to identify its servers across multiple products: Following standard industry practice, we make sure each IP address has a corresponding ...
0
votes
0answers
46 views

To what extent should I change my Tor SOCKS policies on a router?

I read in the Tor settings file that I had the control on the Internet protocol that exchanges network packets between a client and server through a proxy server, SOCKS. To what extent leaving the ...
14
votes
2answers
2k views

Split an application into user and admin parts for security reasons?

I'm currently developing an application which needs to have the ability to manage users. If a hacker would have access to the administrative section, he would have access to sensitive information and/...
10
votes
3answers
14k views

How can I keep a roommate from seeing my web activity?

I have a roommate who is a network security engineer and I think he hacked our home network and now knows what sites I am visiting and what I am doing online. Although he is not stealing anything I ...