Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

5
votes
1answer
402 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
1
vote
2answers
179 views

Nmap says host down when host is up

I am using nmap 7.12 on Mac OS X. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP replies and vice versa. I am scanning an IP inside the ...
0
votes
0answers
32 views

Setting specific geoIP in Piratebrowser

I'm using Piratebrowser. In order to set a specific country's IP, I used the line ExitNodes {in} which is working. I'm getting an Indian IP in dnsleaktest, but my geolocation is getting a Japanese ...
5
votes
1answer
205 views

What about Long Router Passwords and WPS Push-Buttons

I have a question related to the WPS push-button capability on my router. I know that there is some material on the web about this question, but I haven't found anything that's current enough for my ...
10
votes
4answers
417 views

How to design a home network for IoT devices?

I'm trying to work out how best to design a home network which contains (potentially hostile) devices. I'm running into my limits of networking knowledge! I have two challenges. Unsecure Devices ...
-1
votes
0answers
25 views

Topic for research and project [on hold]

I have just started my 3rd year of engineering and a professor from my department has said me to start looking for a topic for my research paper and project. I was wondering to publish a research ...
0
votes
0answers
85 views

My ISP provider is spoofing DNS [on hold]

My ISP provider is DNS spoofing OpenDNS, Google DNS, Norton DNS, Yandex DNS and all other known DNS servers. So even if I use those, I still can't access some websites. So I need a DNS server which is ...
0
votes
1answer
24 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
0
votes
0answers
42 views

ARP spoofing on WLAN: seeing only traffic coming back

I am attempting to capture network traffic of my mobile device connected to switched network via WIFI, utilizing arpspoof. I did all steps tutorials mention. What I see in Wireshark is only a half ...
3
votes
2answers
225 views

Is this enough for an NIDS

I am doing my senior project on network intrusion detection system (Ethernet networks) and I am having a bit of trouble deciding if I have added enough features. Currently the system detects the ...
3
votes
0answers
31 views

Identify malicous hosts in our network by sending valid domain credentials

We are currently whitelisting the hosts owned by our company on our Cisco switches to prevent private hosts in our network. This works pretty well but someone can still spoof the MAC address of his ...
8
votes
3answers
331 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
0
votes
1answer
28 views

What does it mean when airodump-ng shows 0 beacons?

I have one particular AP that shows 0 Beacons in airodump. I can see the beacons in all the other AP without a problem. So is it even possible for AP to not send beacon frames?
1
vote
3answers
176 views

Can bad guys record phone conversations without the carrier's knowledge?

I know that, in most of the world, phone conversations are transmitted as digital data (whether frames in circuit switched protocols or packets). I know that several companies offer products which ...
3
votes
2answers
429 views

What prevents this session hijacking from occurring? (SMB/CIFS example)

SMB/CIFS (file sharing, Windows environment) I understand when a client connects to a server there is a challenge/response system in place. However, once the client is connected that "connection" is ...
97
votes
14answers
28k views

How can mom monitor my internet history from a distance?

This might sound like a funny question from a twelve-year-old. The less funny part is that I am 21 and currently studying at university (I don't live at University, although I am 15 minutes away. I do ...
4
votes
1answer
1k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
0
votes
3answers
229 views

Decrypting SSL over a mobile network

I work for a large company and we are trying to judge the safety of some proprietary information that is being sent and received in a new application we are developing. After our initial testing we ...
11
votes
3answers
13k views

How to get MAC addresses of devices which are not in the network

Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux) I have been trying to get the MAC addresses of devices connected to my network through ...
1
vote
1answer
56 views

How to capture all traffic from a new device?

I have a new IoT type of device that requires a wifi connection to work. I have no use for the device but I'd like to poke around it and learn more about it. How should I go about intercepting every ...
3
votes
2answers
90 views

What are the risks of still using a 1024-bit certificate in a private network?

One of our colleagues ran a Qualys scan on an internally used product and found that the product still uses 1024-bit certificates for its modules to communicate with each other. The vendor says that ...
3
votes
2answers
296 views

Is it possible to identify the source of message in whatsapp?

Is it possible to identify the real source of message in whatsapp? Scenario : Texting whatsapp message to a group,one of the group member forwards it to another and it goes on atlast one day it ...
1
vote
2answers
57 views

Key-exchange over the network with more than two peers

Me and my team is developing a multiplayer videogame with a Client/Server-Topology. This secures the match from clients who have the intention to cheat because of server authority but still allows the ...
26
votes
5answers
29k views

Can I detect a MITM attack?

Based on this question here: Are "man in the middle" attacks extremely rare? Is it possible to detect man-in-the-middle attacks, and if so, how would one go about it? In addition, what if ...
0
votes
0answers
12 views

Pulledpork not disabling all rules in disablesid.conf [closed]

Every time I run pulled pork, it disables 6 random rules from my disabledsid.conf and leaves the rest alone. I have hundreds of rules in the disablesid.conf and the path is correct. IE: # example ...
2
votes
1answer
54 views

Virtual network for malware analysis

I'm attempting to do some analysis work on a malware sample but I'm running into a wall. I can't get the malware to execute correctly and talk to its C2 server. In my lab I have a Windows machine that ...
2
votes
3answers
27k views

How to know what others browse through the network?

My friend connected to WIFI and after 5 minutes he told me which sites I had actually been browsing, and who I chat with. My question is: how do I defend myself against this, and also how did he do ...
0
votes
0answers
28 views

How do you receive Clone Pool traffic on a Linux IDS server?

we use IDS servers with suricata on a standard Gentoo Linux. One sensor is supposed to process traffic from F5 network devices, and there is a Clone Pool configured. Clone Pools are the recommended ...
3
votes
0answers
35 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
3
votes
1answer
58 views

IP Spoofing between subnets

I'm new PT. In a test I was required to do, I was given a port in the segment of 172.13.x.x. I was asked to test if I'm able to reach a server at 172.16.x.x. I was wondering (considering there's ...
0
votes
1answer
132 views

Is it possible to bypass sniffing when using port mirroring?

INTERNET <-A-> ROUTER <-B-> PC Let's theoretically think we mirror the port on a ROUTER to a file. So the full network traffic on it. Question: is it possible to still have ...
2
votes
3answers
6k views

How to search for evidence of Camfecting (webcam hacking)?

I'm worried about camfecting (webcam hacking). The camera light on my mac (running OSX) is not on, but it isn't hard wired so that doesn't say a lot. I've ran a virus scan but no signs. Now my idea ...
4
votes
2answers
93 views

Set up a system to sandbox/capture outbound traffic from Windows PC?

Does anyone know of a program/system that is purpose built to allow you to sandbox/contain an outbound connection from a Windows PC? The aim being that you can analyse the data being sent via the ...
0
votes
1answer
32 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
1
vote
2answers
19 views

Is running SNMP v2c really insecure and can lead to compromisses?

I currently use SNMP v2c to monitor switches, servers, ect... to graph for performance. Question in terms of SNMP. Everyone says that running SNMP insecure is a security risk. How is a graphing ...
4
votes
1answer
250 views

Can the windows Remote Procedure Call subsystem be modified from the default without causing Windows 8/8.1/10 to break?

This is a question that personally as a security professional has bugged me for a long time. So, a default Windows installation, from XP up to 10, typically has a few services listening on the quad-...
20
votes
6answers
29k views

Why is WPA Enterprise more secure than WPA2?

In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
0
votes
0answers
49 views

How to view which ports are opened on firewall?

I have a perimeter modem that should have a firewall, but the admin portal does not display much useful info on what settings it has and whether it is on or not. How would you get a list of open ...
0
votes
1answer
130 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
-1
votes
1answer
75 views

Deauthenticate ALL wlan networks/clients in range [closed]

I need to deauthenticate all clients in all networks within the range of my wlan-adapter. Aireplay-ng allows only to focus a single network. Are there any programs or scripts i can use for this ...
2
votes
0answers
18 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
-1
votes
3answers
146 views

Who can spy on my wifi usage and websites I visit?

I'm using a WPA/WPA2 encrypted WiFi. Who can view what I'm doing? Also how? Can the person that pays for the WiFi look up exactly what I am doing (e.g. look up exact messages I've sent on Facebook)?...
44
votes
10answers
52k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
1
vote
1answer
65 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
0
votes
1answer
49 views

Following strategy using DDoS mitigation service - UDP bandwith exhaustion attack from spoofed IPs

I need to defend against receiving a massive spam of UDP packets from random spoofed IP addresses. I would make it this way: In my protocol, every UDP packet contains username and password. Firewall(...
1
vote
2answers
203 views

Kali Linux/Metasploit in VirtualBox - Issue with ports

I've been attempting to get port 4444 to open these past couple of days. I finally figured I'd try to get it working on my Windows machine first and I finally got it. Now, no matter what I do in the ...
0
votes
1answer
142 views

Is it safe to be showing my WAN and LAN IPs in my email headers?

I don't know how to hide my LAN IP from my email recipients. My LAN IP shows up next to my WAN IP in my outgoing email headers (sent to my other accounts and viewed by me). I have not seen emails sent ...
0
votes
1answer
83 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
1
vote
3answers
13k views

Is there any solution for block the HTTPS traffic using URL filtering?

The URL filtering can block the HTTP traffic but not the HTTPS traffic in Internet Explorer. For example, the website http://www.facebook.com is blocked by the URL filtering while the https://www....