Network Security - securing network infrastructure and connections

learn more… | top users | synonyms

35
votes
3answers
3k views

Why should servers be placed outside of the corporate network?

In an answer to How do you deal with massive port scans?, user tylerl said: ... And you, like a wise IT admin, run all your servers elsewhere on the internet, not inside your corp network, for a ...
-2
votes
0answers
31 views

Do smartphones produce cnonce when connecting to secured networks or when logging into user accounts? [on hold]

Do smartphones produce cnonce when connected to secured networks or when logging into user accounts ? I know that computers generate cnonce and use cnonce for verifying users. My question is do ...
0
votes
0answers
68 views

Isolating Computer on Home Network Using Multiple Routers

My goal is to isolate a computer on my home network. This computer (a rapsberry pi) should be considered untrusted and is accessible from the internet (port 22). I need a solution that will prevent ...
25
votes
4answers
4k views

How do you deal with massive port scans?

This morning I was looking through firewall logs and saw there were about 500 packets marked as port scan. The scanning range was from 1000-1200 5000-5200. The IP address is 85.25.217.47 which seems ...
4
votes
1answer
433 views

Is my server being used as a proxy or being attacked?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am unfamiliar with the security and server side of my project. Recently, my site was down because of "too many users" so when I ...
1
vote
1answer
56 views

Would you typically want to monitor all ports for NIDS monitoring? If so, is span port or network tap the way to go?

We're setting up NIDS monitoring and the bosses want to monitor all the ports, but I'm wondering if this actually makes sense. The switch we're currently using can only mirror 4 source ports to one ...
-1
votes
2answers
64 views

History of connected devices to my internet router (WIFI) [on hold]

Note: same question here, however I was not able to comment because it was by an unregistered user account. Simply, how can I know who (devices) has connected to my network WiFi without using tools ...
3
votes
1answer
54 views

Can still ping from secure network?

I have a standard network and wanted to make a more secure one so I bought a second router and set it up as a separate network daisy chained so it can get internet. I managed to make the setup, with ...
-1
votes
0answers
25 views

History (logs) of connected devices to my internet router (WIFI) [duplicate]

Simply, how can i know who has connected to my network WIFI? without using tools that run on PCs to monitor the traffic. Is there is a way?
-3
votes
0answers
50 views

Full mesh and partial mesh networks [closed]

I have a homework question that says true or false: service providers only implement full mesh networks because of the need for reliable and available communications. this is true because they need ...
1
vote
2answers
74 views

Which of the TLS/SSL and IPsec protocols is effective?

Which of those two protocols is the most effective for sending data from a client to a server on a local network (knowing that I aim to use it for FTP traffic)?
0
votes
0answers
38 views

Setting up a secure Network [migrated]

I have a home network that I want to make more secure so I brought a second router with the aim of setting up a second, separate network at home to put the more important device on. I checked out the ...
1
vote
3answers
115 views

How can I find an unauthorized/unknown proxy on my home network?

I recently started receiving an error while trying to stream netflix that I'm using a proxy. Exactly this error code here: https://help.netflix.com/en/node/277?ba=GSButtonClick&q= My problem is ...
2
votes
1answer
81 views

Linux responds to ARP requests for other interfaces - could this be a security vulnerability?

Linux responds to ARP requests on all interfaces by default. To explain, say you have this setup: Client 1 ---> [eth1] server [eth0] <--- Client 2 And the server's eth1 IP is 192.168.1.1 and ...
0
votes
0answers
26 views

LAN client attempting to connect to many unkown IPs on Boot [migrated]

I have a Zywall 110 Firewall. While perusing the logs I was seeing random bursts of attempted connections to unknown external IP addresses from a single LAN client computer. I noticed because I would ...
-3
votes
4answers
155 views

Is it possible to hack a single computer without injecting a payload or a virus? [closed]

I know the ways to hack a computer or a mobile phone by injecting payload using some exploits with metasploit. We can inject a exe, or we can use pdf file, or docx file as I know. I wonder the ...
0
votes
2answers
113 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
0
votes
0answers
17 views

airbase-ng: How to apply `iptables` rule to packets on `at0` tap-interface

airbase-ng: How to apply iptables rule to packets on at0 tap-interface Reading a tutorial on the net, I see this iptables command used with the tap-interface at0, created by airbase-ng. iptables ...
39
votes
5answers
6k views

Is this an evidence of a Skype communication being spied on?

A couple of days ago I was having a conversation using Skype, then I wanted to share a link to a page with the interlocutor. I didn't want to let her understand the link content by just looking at the ...
0
votes
2answers
119 views

Beginner > Medium > Advanced Books/Guides/Tutorials on TCP/IP [closed]

Long time web developer looking to get into infosec. Was hoping on guidance on material from a beginners stance on TCP/IP and hopefully "networks". I realise the massive generalisation I'm making but ...
-1
votes
0answers
47 views

Deleting from USB on shared workstation/profile in enterprise network

I'm curious about something which, apologies, is hard to succinctly say in the subject line. In any case, here's what I've done (and has me worried as an employee for lack of caring on my own part). ...
4
votes
1answer
311 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
3
votes
3answers
5k views

When do I use IPsec tunnel mode or transport mode?

I basically understand how tunnel mode and transport mode works, but I don't know when I should use one instead of another. Among the two parties who want to communicate, if one computer B doesn't ...
3
votes
1answer
45 views

How can I view images in forwarded packets on (current) Mac OS X?

How can I view reassembled images on a Mac being used as a router? I'd like to do this as a demonstration of how HTTP doesn't provide privacy. I've done some research, and on Linux there's a tool ...
4
votes
3answers
156 views

How does a Man In the Middle attack happen in reality

I am trying to improve the MITM protection of an iOS app I am responsible for, so I want to understand exactly how it happens. I have set up Charles to act as a proxy which required setting the proxy ...
4
votes
1answer
666 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
3
votes
0answers
49 views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
0
votes
0answers
35 views

Is the OS the exclusive “owner” of the network traffic?

I boot up a fresh OpenBSD on a notebook. The notebook has an ethernet port and a wireless card. Does all the traffic on the ethernet and wireless goes through the OS? So if I shut down the ...
1
vote
2answers
103 views

How to route all traffic through TOR?

I have TOR setup on my macbook and I configured my wifi connection to use TOR's SOCKS Proxy that is running on port 9050. When I check my connection it confirms I am browsing through TOR. However, ...
1
vote
2answers
610 views

Bridge Exploit of Network Multi-function Print/Fax Devices

I performed a recent security audit and was wondering if anyone has heard or run across any known exploits against any commercial multi-function print/scan device whereby you can bridge the incoming ...
4
votes
1answer
62 views

Evil Twin attack: How to make client send WPA2-PSK password when asked for AP-password? [closed]

How can an Evil Twin attack be set up, so that the client will be prompted for a password and send it in plain text? Is the above even possible? I have already set up the fake AP, but it must be ...
3
votes
3answers
474 views

Sniffing the sniffer

A sniffs B while B is sniffing C. What's the traffic in A? Does A catches both B and C traffic or only B's?
15
votes
3answers
6k views

Can an attacker sniff Mac addresses on a wifi?

If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
-3
votes
2answers
79 views

Defense in depth

How is defense in depth strategy different from network security policy? What is the need to name it a "Defense In Depth", although you may simply name it "Network security policy"? Secondly if DID ...
3
votes
0answers
218 views

Security for Hospital IT

I'm developing a program in Java intended to be utilized in a hospital. The system uses RMI internally between workstations and the server program. The program would be installed on the hospital's ...
0
votes
5answers
251 views

My email hacked

Someone has definitely gained access to two of my alternate emails. I know this by looking at the login activity. By looking at the email logs I discovered that the IP that is always gaining entry to ...
0
votes
1answer
51 views

Is it safe to host passwordless web applications/software with web GUI in Virtual Machines

I have a Linux Mint Virtual Machine which I use quite a lot with my Windows host. I have lots of Software installed there (mostly with web GUI so I can access them from host easily). So I am ...
-1
votes
1answer
37 views

Eavesdropping and sniffing attacks [closed]

Assume we have two routers connected by a link. Speaking of eavesdropping and sniffing attacks, does it technically appear at link itself or at the routers? If at the routers, does it imply that these ...
36
votes
11answers
32k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
1
vote
1answer
555 views

802.11 Authentication/Association and WPA/WPA2 authentication (Four-way handshake)

So I have read that 802.11 standard requires stations and APs to go through the authentication and association before communication can take place. I also know that WPA/WPA2 has its own authentication ...
0
votes
1answer
72 views

Hiding using VPN

I have just connected to a vpn server in my University using Cisco AnyConnect. But when I check http://whatismyipaddress.com/, it still says that I'm in the same country as before I connected to the ...
1
vote
2answers
72 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
-4
votes
1answer
38 views

Using stingray against police (idea) [closed]

This is focusing on UK mainly, where police radios are similar to mobile phones. Pretend it's possible to buy Stingray, the IMSI scanner. Pretend Jimmy is a criminal, waiting for a police raid at any ...
4
votes
3answers
595 views

How do RATs access computers through routers?

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are ...
-1
votes
1answer
30 views

Which method is the best for IDS : heuristic or signature based? [closed]

In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack. Problems: New attack that has been specifically constructed in order to not ...
1
vote
2answers
240 views

Security risk of connecting one mobile device to another mobile device's hotspot

Is there any risk when connecting an Android Phone to a [Verizon] iPhone's Hotspot? If there are I'd like to know about solutions. The Android Phone will basically be tapping the data plan of the ...
3
votes
1answer
91 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
-1
votes
0answers
18 views

FIN Flag - Evade Firewall [duplicate]

I would want to understand how which setting a FIN Flag. That flag closes the connection. Can someone explain me how FIN Scan do it?
3
votes
1answer
235 views

Performing an airport scan on my Mac for available WiFi networks pulls up multiple SSID with different mac address. What's going on?

I performed the following command to search for available WiFi networks in my apartment complex: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport scan | grep OBC I ...
108
votes
7answers
98k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?