Tag Info

Hot answers tagged

7

Have a good look at this question on DDoS mitigation - it is not something you will be able to solve by buying a faster switch, as an attacker can always get more traffic sources than your network can cope with. All the workable solutions manage it with routing or dropping packets within the ISP - if your ISP doesn't offer a solution you should consider ...


5

You have a number of ways to restrict torrents: Blocking ports: this doesn't work, because p2p traffic can use pretty much any port (even ones below 1024) Deep inspection: looking at traffic and blocking based on type can help you a lot, however encrypted traffic all looks alike Destination filtering: this may also help a bit, but you'd have to maintain a ...


5

Cisco's own SDM (Security Device Manager) performs some basic auditing. "Cisco SDM allows users to perform one-step security audits to evaluate the strengths and weaknesses of their router configurations against common security vulnerabilities." For a list of features included, see AutoSecure Features Implemented in Cisco SDM . Another well-known tool is ...


5

Here's how to do it: tunnel_vpn_userX controls what subnets to tunnel, filter_vpn_userX applies normal access list filtering within that tunnel. object-group network tunnel_vpn_userX_local network-object <some local network> ... access-list tunnel_vpn_userX extended permit ip object-group tunnel_vpn_userX_local any access-list filter_vpn_userX ...


4

Context works great, what you want to know before deploying it is the unsupported feature in context mode: http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/contexts.html#wp1146747 I never see any performance drop when enabling context mode


4

The Cisco ASA config you have provided appears to use CISCO PIX-MD5 hashes. Both the VPN settings mentioned above and the enable/passwd are not salted, contrary to what the hashcat.net thread suggests in Peleus's post. It is worth while checking this site: Nitrix Hash Generator In there you can enter 'cisco' as the password and you'll recieve the common ...


3

There is no way to enforce this on a Cisco router. The only thing you can do to harden your setup is to at least disable SSHv1 by running: #ip ssh version 2 However this will still not disable CBC and 96-bit HMAC/MD5 algorithms. Cisco does not offer capabilities to fine tune your SSH server so deeply. The only thing you can do is force the a connection ...


3

From your description, I suppose that your router was configured such that: Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah". When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to ...


3

You can also check out Nipper (http://www.titania.co.uk/) Nipper enables you to perform your own comprehensive security audits of your network devices. Nipper supports around 60 different network firewalls, switches and routers from a wide range of manufacturers such as Cisco, HP, Juniper, Check Point and Extreme Networks. It's cheap: $85 for ...


3

The simplest way to mitigate BEAST is to do nothing at all. BEAST is a client attack. Servers can "protect" clients by enforcing the use of RC4-based cipher suites even if the client states that it prefers some CBC cipher suites. However, all recent Web browser versions include workarounds which make them immune to BEAST, namely the 1/n-1 split; and the ...


3

For general understanding, vtp allows central management of vlan domains, id and other attributes. It governs how other switches learn and understands vlan. Any updates related to vtp management is sent by the vtp server. Here, the risk lies when the md5 hash is known either by compromising the switch and running commands such as e.g show command, show vtp ...


3

There is no sure-fire way to determine IOS and model without getting the router itself to do it. Typically this would be done using telnet or ssh and typing in "show version", which is not an elevated command. Many implementations have poor VTY passwords, so don't rule it out. Also worth trying is using SNMP to poll the router, you can use cisco's MIB ...


2

It depends on what routing technology that you use. I know cisco switches have a optional security setting on allowing only a few MAC addresses associated with a port. See port-security. This makes it impossible to set up a bridge between your network and your colleague's network, as the bridge will proxy the arp packets between the two networks, hence ...


2

Use enable secret -- if nothing else, it's the solution that works on "legacy" versions, even if it has been changed in newest releases. (Apart from that, avoid local accounts. The only time a local account should be used is when there is a major problem in progress that prevents the router from communicating with an AAA server. Use TACACS+ when possible, ...


2

Having recently had my 5510 taken down in a SYN-flood DDoS, the key thing you need to know is how big the DDoS is going to be. Our ASA 5510 hit its limit at 140,000 packets per second. Although the specs say 190,000 packets per second, other factors can influence the actual rate achieved. The 5505 can handle fewer packets per second than the 5510. Higher ...


2

Depending on your model of PIX, and what version of the OS is loaded on it, you actually have a lot of options. If you have something with PIXOSv7 or higher (that is a 515 or better with at least 256MB of RAM) you can run your PIX in either routed or transparent mode. So what you could do is: switch1 -> router -> firewall(transparent) -> switch2 ...


2

Use the AnyConnect VPN Client, Cisco VPN client does not support x64 The Cisco VPN Client supports: XP, Vista (x86/32-bit only), Windows 7 (x86/32-bit only), and Windows x64 (64-bit). Windows x64 support also provided by Cisco AnyConnect VPN Client Linux (Intel) Mac OS X 10.4 and 10.5 Solaris UltraSPARC (32- and 64-bit) Source: ...


2

From the paper you quote, additional Symbiotes would both complicate the code rewriting scenario, making disabling them theoretically more difficult; and the Symbiotes could be made to protect one another, making disabling them practically impossible. The attacker would need to get a precise image of all their entry points and disable them all in one fell ...


2

Given that NIST has a copy of a Cisco document calling this out specifically, I'm going to think the answer is Yes. IANASA (i am not a security auditor) http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140sp/140sp948.pdf


2

BitTorrent can run on any port, and can be wrapped inside SSL, so blocking by ports or traffic data isn't going to get you anywhere. My suggestion would be to block HTTP traffic on any port which matches the tracker announce protocol, as per the specification. This won't work if the tracker is running on HTTPS, but most don't. It also won't prevent DHT from ...


2

Given that: current browsers (including IE6) have patches to work around BEAST, it's a difficult attack to perform anyway, and there has been progress in attacking RC4 of late, preferring RC4 as a measure to defeat BEAST seems of questionable utility. It is certainly not a clear-cut win, and shouldn't be represented as a necessary basic security measure ...


2

Absolutely. There are tools like Aircrack which are dedicated to cracking WEP and WPA-PSK keys. WEP keys can often be cracked in less than 10 minutes while WPA keys may take a few hours. Therefore, you should always choose WPA when setting up your router's security. Now, I suggest that you reset completely your router's settings to default and reconfigure ...


1

Your iptables rules look generally fine to me, although I cannot spot how you are enforcing 22 from the VPN only (unless you have configured sshd to only listen on the VPN IP, which should be ok). Also you can use POLICY (-P) rather than your bottom two rules, but either should be fine.


1

The easiest way is to use an online tool. It may have already stored passwords and their hash: http://www.ibeast.com/content/tools/CiscoPassword/index.asp Using Cain and Abel you should be able to crack your current password of 2KFQnbNIdI.2KYOU fairly fast with a dictionary or bruteforce. Not sure of the issue you are having with Cain but it should work ...


1

The firewall isn't randomly denying the packets, and it is very unlikely that they are being dropped because of a bug. In all likelihood the packets are being dropped because that is what the policy says for the firewall to do. Port 3478 is STUN, a protocol used by UDP for NAT traversal. There are some possibilities: The traffic is authentic, and the ...


1

There won't be a crypto breach. You have to use thoroughly bad cryptographic algorithms to actually get in trouble that way. For instance, in your listed encryption algorithm, only DES is breakable in practice, and even then it is still a rather daunting task (256 encryptions, that's not a week-end's computations on a gaming PC). The biggest impact of ...


1

There are secure options, and less-secure options. How you order the secure options is less important than that you avoid the poor choices. For example, DES is pretty handily broken because the key length is insufficient. It should simply not be allowed. 3DES is slow but theoretically not broken (though some say that certain governments have optimized ...


1

Yes it is. The default configuration for the snmp server is enabled. If you do a sh run all | i snmp you should see a snmp-server enable line in your configuration. However if you'd like to actually use the snmp server you'll need to add a snmp-server host x.x.x.x command to the config.


1

If you suspect a local device such as a fax machine being unintentionally forwarded, change the id of the device. If you can recall when this first started, it may shed some light on this. I would look for teleconferencing voip equipment as well. Why was this listed as fraud -- did you have prior issues with fraudulent calls? Do you have any disgruntled ...


1

I can't help with your basic problem, but this should help motivate folks to get it right, as your question asks. It is depressing hearing over and over how badly broken password storage is on important platforms. A bit of googling yields this information on how bad "type 7" password storage is. Note that tt uses "Vigenère obfuscation" (not really ...



Only top voted, non community-wiki answers of a minimum length are eligible