Hot answers tagged

68

You can't hide your IP address on the internet. They aren't secret. Pretty much what @DeerHunter said. It's trivial to scan the entire internet. If they want, they can target all-known digital ocean droplets that are online. They can do this on a timer so that when you go offline, or online, it will just keep trying as those may be high-value targets that ...


43

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


21

The IPv4 address space is limited to only 4,294,967,296 addresses.[note 1] Given enough bandwidth, it becomes trivial to scan every single IP address out there, especially if you're the owner of a botnet consisting of thousands of hacked devices. With IPv6[note 2], things are a bit more tricky: with over 300,000,000,000,000,000,000,000,000,000,000,000,000 ...


18

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


11

But how do they know that I do exist? They don't know that you exist. They don't know they're talking to you: they just know they're talking to a computer with a particular IP address. IP addresses are a lot like phone numbers. If you dial a legitimate area code followed by a random number with the right number of digits, there's a decent chance ...


4

The point of a spray is that you don't always know exactly which block your object was allocated to. I believe it's because how volatile the heap can be. At any given time a block of memory could be allocated, and your NOP sled/shellcode could be interrupted. You see examples with predictable addresses because it makes it easier to learn the concept, but ...


3

I use Snort or Suricata on pfSense to automatically block IPs for a time period. Sophos UTM appears to have similar functionality.


2

You can add the mac adresses you want to attack in a blacklist file, and run mdk3 with the -b flag. Since you used the -w flag, it disconnected everyone except the target.


2

The act of setting up an evil twin is not sniffing, but the generally accepted definition (CISSP) is that the purpose of the evil twin attack is to harvest credentials, etc. It might also be argued that the evil twin attack is not strictly a sniffing attack if the attacker only uses it to DoS the people on the network.


2

The simplest way of dealing with this I can think of is to more or less implement CBC mode yourself. All it requires is for you to be sure of the block size used: Build a random (and unique) IV of the same size as the AES block size (128 bits). Encrypt that block and store the result (let's call it A) Build a chain of 128-bits blocks containing your actual ...


2

Nothing to worry about. This is regular internet noise, there are a lot of robots on the internet scanning the internet, even doing full IP traversals from 1.1.1.1 to 255.255.255.255 so even if your domain name is known only by you, someone will eventually scan your IP address. Since the logs are calling javascript files there's nothing to worry about. ...


1

But how do they know that I do exist? They know that something exists on that IP address because their scanner is telling them so. Most likely they didn't come looking for you, they just stumbled across that IP address by scanning large chunks, or the entire internet. http://blog.erratasec.com/2013/09/masscan-entire-internet-in-3-minutes.html


1

After I see someone scanning I usually do a little recon on who they are, if they are on known blocklists I usually ignore and let the firewall drop it (ASAs). If they are an unknown entity I'll add a rule to drop connections with our IPS from that IP. I have used suricata in the past and will give that a +1 as it could help in a situation like this as the ...


1

Since most everybody talks mostly of disadvantages (which are real), I'd like to share several advantages here: you really want to avoid automated attacks. Unless your are a high-profile user, vast majority of attacks will not be targeted to you, but automated best effort attacks which would just try default ports. Avoiding them helps in several ways: ...



Only top voted, non community-wiki answers of a minimum length are eligible