Tag Info

Hot answers tagged

60

Most likely, it's just trying to check if there's a working internet connection. The malware authors assume that: Google (or other Alexa Top-1M sites) will be up 99.999% of the time. Traffic going to common productivity sites like Google will not be flagged as unusual. You (or your network administrator) will be unlikely to have blocked these sites at the ...


12

Simple connection testing is one reason why malware might connect to Google, Yahoo and other search engines, but I would like to present a different explanation. One frequent application for botnets is search engine spam optimization. As you might notice, the result page of Google (and most other search engines) doesn't lead to the results directly, but ...


6

I think I would tackle it in this manner: Why is there an existing separation of the physical networks? By installing another NIC in the server and connecting it to the other network you are in effect bridging the networks, physically and via NetBIOS. This renders the whole point of keeping the networks separate essentially moot. What is the ...


6

I'm just guessing here. But it would provide an alternative solution to the problem of name resolution to use a search engine instead of DNS to find a CnC server or to poll for updates and campaigns. It's not clear from the web page if it were simply hitting the front page or running a query - and I don't have tools here to read the pcap files myself. Even ...


5

The justification you should give is not a technical one. You should phrase it in terms of risk. Put simply: The corporate network contains information that is sensitive. The systems connected to that network and the and users that use them have a certain level of risk associated with them. The security controls on the corporate network have been ...


5

It's impossible to say. Assuming you don't have any ports forwarded to the PC and your router provides a DHCP server for your LAN, you aren't vulnerable to the classic attack vectors (CGI scripts on a webserver, a rogue DHCP server, or bypassing SSH command restrictions). However, bash is ubiquitous: you might be vulnerable to a program running something ...


5

What you mention is referred to as IP conflict. Most probable reason is misconfigured static settings on the other computer, nothing to worry about. Or it could be a DoS as in the router won't know where to forward the packets. In our eduroam infrastructure we automatically block these situations. Consult your University's NOC (Network Operations Centre, ...


4

Rogue access points can certainly be dangerous, but there is a caveat: If the "real" network is encrypted, you cannot set up a rogue access point without knowing the key. Rogue access points must have exactly the same security settings as the original access points, including the same key. If they do not have the same key, clients will try to connect but ...


4

Just because the IP shows as Allocated unspecified does not mean you are being hacked. This IP status is because you asked the wrong entity, as ripe.net is not the responsible for allocating that IP. If you look at IANA IPv4 Address Space Registry, you would see that this IP range is managed by ARIN. If you ask arin.net, you would see that the IP is owned ...


3

Consider this command: nmap 127.0.0.1 -T4 -p 111 -sT -oG - | awk '/^Host:.*Ports:.*([0-9]+\/open\/)+/ { print $2" UP" } A common pattern using shell scripting is to use grepable output. Use the flags "-oG -", the final dash is to redirect output to stdout. Output from "-oG -" in this example outputs the following when I ran it at my own server: Host: ...


3

Edit: I totally missed the home network part. Purchasing a network tap in this situation would be overkill. In your case Snort or Suricata could work. You could specifically make rules to search the packets for strings that would indicate insecure communication. You could further tune it by removing all rules not pertinent to what you're looking for, ...


2

In most of the countries I am aware of, network sniffing tools themselves are legal. The law is worded such that acts are legal or illegal, rather than the tools that may be (mis)used to commit those acts. There slight are exceptions to this, in that production of tools whose sole purpose is illegal (e.g. writing malware) may also be illegal, but then it's ...


2

I remember a case (but not the name of the case) where malware would periodically send blank http requests to big and reliable websites to get a reliable UTC, the malware was designed with a timed bomb on it, set to Denial of Service a specified site at a certain date/time.


2

A firewall may work at different layers of the OSI model, going from layer 3 to layer 7 (depending on your firewall). Representing it in a diagram will require to set rules for each layer. I would represent the firewall and include a list of all enforced rules on each layer. Some examples could be: Layer 3: IP filtering Layer 4: port filtering (TCP/UDP) ...


2

In this case you may want to get a network tap or set up port mirroring if your router supports it. From there you can install an IPS (either manually make an image or use security onion). You might want a deployment style similar to below. However in your case the firewall will most likely be your internet modem and your LAN will be your router.: Or if ...


2

If you have some extra hardware around i recommend trying Security Onion. It has snorby and suricata already installed and can be run in a few different deployment styles (one machine, listening posts etc). Might be just enough information for you. You could of course also hub out your home network and tcpdump/wireshark your traffic and see.


2

Unfortunately your question is lacking some details, but I can give you some food for thought on this that will help put this in context. First of all there are different protocols that could be used for an attack such as ICMP, or UDP or TCP. Without knowing more about the target or type of traffic generated it's hard to truly predict what impact it would ...


2

Probably somebody is calling you with voIP phones... you can make it seem as if you are calling from any number or even make it appear as is "xxx bank" or whatever. So no biggies on that part. It is very popular nowadays to call people from voIP systems with fake caller info. On your second question, being called from only known people... Look for a ...


1

The information you do not understand how to interpret? like the WhoIS information? I think you should clarify that a bit more because I am not sure if maybe you are seeing an IPv6 address or something more specific like the information about that IP. In most all cases involving Facebook, Yes. The addresses are either logged into your account already. ...


1

If you see different IP addresses on Facebook, don't panic. Some of them are APIs from services you connected to Facebook, like Instagram. Some of them are services that use Facebook to authenticate you. If you are concerned about someone hacking into your Facebook, you should activate 2-way authentication. With this, you will be informed every time ...


1

I'm going out on a limb here and going to say you are talking about: http://en.wikipedia.org/wiki/Hamachi_(software) Since its a publicly available VPN, connecting to a Hamachi network is a lot like connecting you your own LAN; except for the fact that EVERYONE on the Hamachi network you are connected to is unknown and can pose a very real threat to anyone ...


1

If you always receive the calls from the very same person, then it might be a trojan on THEIR phone that calls you. However, if theres calls from multiple persons, then it might be the thing that people call "pocket calls", basically, the phone sits in pocket along with keys, wallets, and other objects that push buttons and/or touch touchscreen which in ...


1

I used something like this (powershell script) recently to determine simply if the server receives a response back. i know it's not nmap but it is quick and easy. $erroractionpreference = 'silentlycontinue' $import = import-csv 'config-network device.csv' $collection = $() foreach ($HostName in $import) { $status = @{ "ServerName" = ...


1

Just check the job sites and see what employers are asking for. My opinion -- seems like for Management type positions the CISSP is favored among others. For Analysts and Techs probably any cert that includes practical working knowledge (EC Council CEH) or lab components (Sans GIAC certs). How much money you have and are willing to spend on a certification ...


1

I would advise to start with Comptia Security Plus after you gain some information security experience you can opt for C|EH or advanced certifications like CISSP/CISA/CISM (Sans - Intermediate and above Certs). Sec+ ->CEH->CISSP/CISA/CISM or Sec+ ->GCIH/GCIA->CISSP/CISA/CISM You can opt for CISSP earlier in your career by taking the CISSP and if you pass ...


1

You are unable to see the rest of the network now because you have connected a router between and you are now basically on a 'separate' network --- check the IP addresses --- if they are not all in the same CLASS then you are on different networks and cannot see everything, although, technically everything is connected together. Secondly, a mac address is ...


1

As MemCtrl said it could be a misconfigured static settings on the other computer: In my old school there were 20 desktop with static IP addresses. If I assigned to my laptop one of those IP addresses, one desktop showed an alert message like yours. By the way you shouldn't worry about this. Try to consult the University's network administrator.


1

You're definitely on the right track refusing this, and there are two main points to why. The first one is more operational, the second is more risk related. Ultimately, however the important thing is to call these risks out and balance them with the cost/benefit involved. If your network already has a firewall and DMZ configured, then it should be easy ...


1

You seem a bit confused about the concept. An open redirect is just a redirect. You browse to http://google.net/redirect?http://stackexchange.com and it tells your browser: please go to http://stackexchange.com. That it is an open redirect means that I can make it send you to anywhere (like an attacker web page), usually by embedding in the link the page ...



Only top voted, non community-wiki answers of a minimum length are eligible