Tag Info

Hot answers tagged

9

You have a number of ways to restrict torrents: Blocking ports: this doesn't work, because p2p traffic can use pretty much any port (even ones below 1024) Deep inspection: looking at traffic and blocking based on type can help you a lot, however encrypted traffic all looks alike Destination filtering: this may also help a bit, but you'd have to maintain a ...


7

Have a good look at this question on DDoS mitigation - it is not something you will be able to solve by buying a faster switch, as an attacker can always get more traffic sources than your network can cope with. All the workable solutions manage it with routing or dropping packets within the ISP - if your ISP doesn't offer a solution you should consider ...


5

Cisco's own SDM (Security Device Manager) performs some basic auditing. "Cisco SDM allows users to perform one-step security audits to evaluate the strengths and weaknesses of their router configurations against common security vulnerabilities." For a list of features included, see AutoSecure Features Implemented in Cisco SDM . Another well-known tool is ...


5

Here's how to do it: tunnel_vpn_userX controls what subnets to tunnel, filter_vpn_userX applies normal access list filtering within that tunnel. object-group network tunnel_vpn_userX_local network-object <some local network> ... access-list tunnel_vpn_userX extended permit ip object-group tunnel_vpn_userX_local any access-list filter_vpn_userX ...


5

With physical access, so many parts of your network could be compromised. I'm not sure I would be looking at the cable and light, but at more basic things, like USB drives, rogue wifi access points, computers left logged in...


4

Context works great, what you want to know before deploying it is the unsupported feature in context mode: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html#wp1146747 I never see any performance drop when enabling context mode


4

The Cisco ASA config you have provided appears to use CISCO PIX-MD5 hashes. Both the VPN settings mentioned above and the enable/passwd are not salted, contrary to what the hashcat.net thread suggests in Peleus's post. It is worth while checking this site: Nitrix Hash Generator In there you can enter 'cisco' as the password and you'll recieve the common ...


3

You can also check out Nipper (http://www.titania.co.uk/) Nipper enables you to perform your own comprehensive security audits of your network devices. Nipper supports around 60 different network firewalls, switches and routers from a wide range of manufacturers such as Cisco, HP, Juniper, Check Point and Extreme Networks. It's cheap: $85 for ...


3

For devices with ACLs you should try Tufin SecureTrack. It reads in the running config file and allows you to perform various kinds of analysis such as ACL overlap report, finding ACLs that match certain access patterns, for example ACLs allowing access from one zone to another etc.


3

The simplest way to mitigate BEAST is to do nothing at all. BEAST is a client attack. Servers can "protect" clients by enforcing the use of RC4-based cipher suites even if the client states that it prefers some CBC cipher suites. However, all recent Web browser versions include workarounds which make them immune to BEAST, namely the 1/n-1 split; and the ...


3

For general understanding, vtp allows central management of vlan domains, id and other attributes. It governs how other switches learn and understands vlan. Any updates related to vtp management is sent by the vtp server. Here, the risk lies when the md5 hash is known either by compromising the switch and running commands such as e.g show command, show vtp ...


3

There is no sure-fire way to determine IOS and model without getting the router itself to do it. Typically this would be done using telnet or ssh and typing in "show version", which is not an elevated command. Many implementations have poor VTY passwords, so don't rule it out. Also worth trying is using SNMP to poll the router, you can use cisco's MIB ...


3

From your description, I suppose that your router was configured such that: Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah". When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to ...


3

There is no way to enforce this on a Cisco router. The only thing you can do to harden your setup is to at least disable SSHv1 by running: #ip ssh version 2 However this will still not disable CBC and 96-bit HMAC/MD5 algorithms. Cisco does not offer capabilities to fine tune your SSH server so deeply. The only thing you can do is force the a connection ...


2

Having recently had my 5510 taken down in a SYN-flood DDoS, the key thing you need to know is how big the DDoS is going to be. Our ASA 5510 hit its limit at 140,000 packets per second. Although the specs say 190,000 packets per second, other factors can influence the actual rate achieved. The 5505 can handle fewer packets per second than the 5510. Higher ...


2

It depends on what routing technology that you use. I know cisco switches have a optional security setting on allowing only a few MAC addresses associated with a port. See port-security. This makes it impossible to set up a bridge between your network and your colleague's network, as the bridge will proxy the arp packets between the two networks, hence ...


2

Use enable secret -- if nothing else, it's the solution that works on "legacy" versions, even if it has been changed in newest releases. (Apart from that, avoid local accounts. The only time a local account should be used is when there is a major problem in progress that prevents the router from communicating with an AAA server. Use TACACS+ when possible, ...


2

Depending on your model of PIX, and what version of the OS is loaded on it, you actually have a lot of options. If you have something with PIXOSv7 or higher (that is a 515 or better with at least 256MB of RAM) you can run your PIX in either routed or transparent mode. So what you could do is: switch1 -> router -> firewall(transparent) -> switch2 ...


2

Given that: current browsers (including IE6) have patches to work around BEAST, it's a difficult attack to perform anyway, and there has been progress in attacking RC4 of late, preferring RC4 as a measure to defeat BEAST seems of questionable utility. It is certainly not a clear-cut win, and shouldn't be represented as a necessary basic security measure ...


2

Use the AnyConnect VPN Client, Cisco VPN client does not support x64 The Cisco VPN Client supports: XP, Vista (x86/32-bit only), Windows 7 (x86/32-bit only), and Windows x64 (64-bit). Windows x64 support also provided by Cisco AnyConnect VPN Client Linux (Intel) Mac OS X 10.4 and 10.5 Solaris UltraSPARC (32- and 64-bit) Source: ...


2

From the paper you quote, additional Symbiotes would both complicate the code rewriting scenario, making disabling them theoretically more difficult; and the Symbiotes could be made to protect one another, making disabling them practically impossible. The attacker would need to get a precise image of all their entry points and disable them all in one fell ...


2

Absolutely. There are tools like Aircrack which are dedicated to cracking WEP and WPA-PSK keys. WEP keys can often be cracked in less than 10 minutes while WPA keys may take a few hours. Therefore, you should always choose WPA when setting up your router's security. Now, I suggest that you reset completely your router's settings to default and reconfigure ...


2

Did anyone perform a hard reset on the device? Usually there is a pin hole button you need to press for a few seconds to reset the device to the default configuration. Just a thought.


2

BitTorrent can run on any port, and can be wrapped inside SSL, so blocking by ports or traffic data isn't going to get you anywhere. My suggestion would be to block HTTP traffic on any port which matches the tracker announce protocol, as per the specification. This won't work if the tracker is running on HTTPS, but most don't. It also won't prevent DHT from ...


2

Given that NIST has a copy of a Cisco document calling this out specifically, I'm going to think the answer is Yes. IANASA (i am not a security auditor) http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp948.pdf


2

If you only allow ONE MAC through a port I can't see how DHCPstarv is going to work (unless it is some kind of distributed DHCPStarv attack). DHCPStarv works by sending a lot of DHCP petitions so that the server doesn't have new IPs to provide to new clients. But if you can only ask for one a time it is not likely the attack is going to succeed. After ...


2

Cisco will need to confirm if they are vulnerable. I expect they are not since the lack of cgi scripting exposed through the web instance for CSM/ASDM. In the meantime you can mitigate a lot of risk by restricting http/https enable to specific hosts in your network.


2

Yes, It's possible that they are vulnerable. Although they are not sure yet. Cisco believes, that devices are only vurnerable, once you're authenticated. Therefore you can only exploit the bug when you'd have admin privilege anyway. Check the following link for more information and status updates: ...


1

Your iptables rules look generally fine to me, although I cannot spot how you are enforcing 22 from the VPN only (unless you have configured sshd to only listen on the VPN IP, which should be ok). Also you can use POLICY (-P) rather than your bottom two rules, but either should be fine.



Only top voted, non community-wiki answers of a minimum length are eligible