Tag Info

Hot answers tagged

32

Today, Skype do not route communication through other users machines. This is done by Microsoft servers in datacenters. But back in the days, in the early versions of the Skype protocol, every user with strong-enough bandwidth and not behind a NAT (with routable IP address), can become a supernode and route the traffic of other users that are behind NAT. ...


23

As others have already answered: Yes, Skype originally did sometimes use other Skype users to route some calls. BUT!!! What the other replies didn't say was: This was actually A GOOD THING! Because Skype was initially Peer-2-Peer based not server based (as Microsoft made it) and all traffic was encrypted from end-to-end it gave Skype two big advantages ...


7

The attacker doesn't connect to the victim computer, the victim computer connects to the attacker. Data in a connection can flow in both directions, it doesn't matter who initiates the connection in the first place. Once a connection is established the attacker is able to execute commands on the victim computer. The attackers use well-known web protocols ...


6

Typically, an eavesdropper (sniffer) will be passive -- that is they will not modify the traffic. Man-in-the-middle (MiTM) attacks usually imply an active adversary -- one who will change the contents of the message before passing it on. The two are not entirely distinct, as a MiTM may use their active attack to read the contents of messages, or simply to ...


4

If you are on unsecured WiFi, all of your internet traffic is broadcasted for everybody nearby to see. This means that any traffic to/from your computer that is not encrypted at another layer (such as SSL/TLS or SSH) will be visible, which can expose sensitive data, such as usernames and passwords, or authentication cookies. In addition to passive ...


4

A switch will try to only send traffic to its intended recipient. But it is not guaranteed. If the switch doesn't know where the recipient is, it will send the packet to all devices connected to the switch. There are ways to make a switch forget where the intended recipient is (such as overflowing the CAM or MAC spoofing). There are also ways to make ...


4

As for the other part of the question: why are users sticking with it while there are better solutions? Two words: market penetration. Average John Doe doesn't care about security or abusing (in the olden days) other network users. He just wants to make calls, this just works and he's not going to persuade all his friends to use something else when ...


3

I think there are many factors that could make it a legitimate request: other people in the home who might need network segregation load balancing old equipment (getting a newer modem) VPN configurations I, myself, have made the same request to a certain remote employee to ensure separation of use within that employee's home. Sometimes it's simply to ...


3

Many copy machines and all-in-one scan/print/copy/fax machines (especially from HP) have internal hard drives they use for temporary storage. It's been in the news from time to time that people have recovered sensitive data from these drives, either using data-recovery software or by simply reading the drive filesystem.


3

Is it common for scanners to somehow cache or log documents they scan (on the scanner machine itself)? Yes, probably nearly all which aren't specially designed to be hightly confidential Does scanner driver/software often have temporary folders which end up leaving a trace of the document? Yes also. Can a networked scanner maliciously or ...


3

You are somehow thinking that dead tree docs are less secure than digital copies. I may venture to say you are mistaken in this belief. Digital data may be stolen in a myriad different ways. The scanner may be reporting to HP or other companies/agencies, while your computer may be already compromised. Your computer will have vestigial data on the hard ...


3

According to my research on the subject, and running tests there are no quick fixes for tracking the source individual perpetrating this type of attack because of the nature of it. Meaning tracking, but not filtering/blocking. The attack method itself is basically easy to do compared to the scale of other types of attacks out there due to fundamental flaws ...


3

Users of applications cannot. They can only try to not have rogue apps running on their systems. In this case we have an app that is normally harmless or even (attempts to be) beneficial unless it detects you're approaching a juicy login. Some, each alone insufficient, ways of "protecting": do not install untrusted apps or from untrusted sources. pay ...


3

I would say a malicious internal actor. Internal actor meaning that he is validly participating in the network, but malicious indicating he's abusing the system.


3

The first step in securing anything should be to evaluate what you need to secure and where somebody might attack you (attack surface). I don't know what you have to protect, but since you are doing your computing in the cloud you should not only ask yourself how to communicate with your cloud application, but how the application itself is secured, that is ...


2

The difference is exactly the same as the language suggest. "Shared key" means that the same key is used by several party. It doesn't tell you how the key was distributed among them. "pre-shared key" means the key has been shared before the current operational context. To go you two examples: When you perform a Diffie-Hellman key exchange in an SSL ...


2

It's sort of like asking the difference between a car and steering. When you are driving a car, you can (and probably should!) steer it. But you can steer a bike too... Enough with the analogy, the difference, in my view, is that MitM is a class of attack and the sniffing is simply the word for analyzing packets on the network (and often just the packets ...


2

A sniffing attack is a attack on confidentiality. It can be via a span port on a switch, processes on servers through which the traffic passes, on the end user client. Sniffing is often an MITM attack but it is passive. A MITM attack is typically a more active attack where the traffic route has been altered to include the adversary, such as a rogue access ...


2

Do some sort of packet capture. Depending on your level of concern and technical ability you have two relatively easy methods available. If you have tcpdump installed just run tcpdump -A -c 200 if the output is clear text then this is a clear answer. If it is not then possibly your traffic is encrypted. (note: it could just be encoded and not encrypted, ...


2

The connections CrashPlan uses are encrypted using TLS. (I've casually seen the traffic when looking at other things.) As for whether or not it's safe: the protocol doesn't really matter, only whether CrashPlan has exploitable bugs in their software, and that's pretty hard to discern without either extensive reverse engineering or access to their source ...


1

It depends on who "they" are. If you're torrenting, the university can use commercial traffic inspection tools to identify p2p protocols. The tools are signature based, and the signatures are proprietary, so the exact methods used and methods to circumvent them vary. If you're torrenting illegally distributed copyrighted content, then the rights holders ...


1

Just to clarify, when you say modem - do you mean just that? Or do you mean router or modem/router? Without a deeper understanding of the infrastructure on the employers end, I honestly don't see how having a separate modem will increase security. It's more important that split tunneling is disabled on the VPN client. Most modern home class routers allow ...


1

Beside what you have already done disabling WPS and using whitelisting: Use the latest firmware Disable TKIP, just use AES. Obviously... change default login / wifi credentials. Use a decent password. Disable UPnP. Firewall policies to DROP, only allowing what you are going to use (80,443,22,53,3389...). Limit the amount of DHCP devices, also set them to ...


1

In the Information Security world, internal attacks or inside malicious attacks are known as Insiders. Someone who can poke, sniff and even can do anything with a trusted identity is an Insider and can install malwares and anything bad.


1

For me, insider attacks and internal attacks perfectly fit your description. If you want to find a more specific name maybe try to be more specific on what kind of malicious activities the node is carrying out in the network. The paper [1] is from the field of wireless sensor network (WSN) security. A WSN is a distributed system of sensor nodes. There are ...


1

There is no good software way to do this. Monitoring outgoing traffic on computer with the camera is no good solution as your traffic stats may be faked. If someone gains such a good access to your webcam to disable the light, faking traffic stats is not a huge step away. You could measure the traffic on your router, but then you would need to read the ...


1

If you are concerned that your ISP provided router may be compromised, you should replace your router with one that is under your full control. Unfortunately, with the pitiful state of home router "security" in general, this may not be that much better. It is true that switches are designed to forward ethernet frames only out of the ports connected to the ...


1

That depends on whether you're talking about local or internet traffic. For internet traffic, it doesn't matter what modem you use; your ISP can see EVERYTHING that you send out onto the internet. After all, they're your bridge to the internet, and everything you do passes through them first. It doesn't matter who the traffic is "addressed" to; it's ...


1

1. Protect the server from getting hacked For this you could find multiple hardening guides, which combines locking down your machine, keeping it up to date with hotfixes and so on. 2. the data stored on the server should be encrypted Ensure your data is encrypted, you could do this using symmetric encryption (you suggested AES, with the key being a ...


1

Normally we call that kind of attack "spoofing". It usually implies that there's some kind of active interaction involved, whereas sniffing is passive.



Only top voted, non community-wiki answers of a minimum length are eligible