Hot answers tagged network
7
So if I was you I would start relatively simply with some VMs and a host machine.
Personally I use VMWare workstation but other virtualization products are possibilities.
If you've got a decent enough machine (e.g. 8GB RAM, Quad-Core Sandy/Ivy bridge, fast disks), I'd recommend keeping the Host OS clear of lab tools or target Apps, as re-building VMs is an ...
6
I think it's referring to "hub" as the center of a hub-and-spoke VPN architecture, as shown in this diagram.
Later on in the document you linked to, it says:
Dynamic—Dynamic crypto maps can only be used in a hub-and-spoke VPN
topology. Dynamic crypto map policies allow remote peers to exchange
IPsec traffic with a local hub, even if the hub does not ...
5
When teamviewer is installed it includes a daemon that runs under the system account. The client that is started under the users account only provides instructions to this daemon.
As this service already has elevated rights assigned at the time of installation (the creation of this daemon) it is possible to directly emulate key strokes as coming from the ...
5
Don't do it. It's an isolated network for a reason, if you need access do it on site, not remotely so you can also monitor and shut down access locally. As I quote Adnan why you use isolated networks:
You don't isolate your network because you're afraid that someone will guess the right passwords. You're afraid of the human factor, the leakage of the ...
5
There are different ways of tackling this:
Disable unused ports (which should obviusly be the first line of defense)
Using port security on your switch makes it at least necessary that an attacker finds out a certain MAC address and connects to a specific port, which will stop most people from plugging their home devices into the company network. In ...
4
Filtering arbitrary connections could be done with a kernel module by hooking netfilter. And anything done in kernel land with a kernel module, can be undone with a kernel module. Also, nothing is keeping root form just installing their own kernel...
root is GOD, never forget that.
4
If it is truly unsecured wireless, then a simple packet sniffer should pick information on the wireless network out of the air though you may have to use special drivers if your wireless card normally only presents information that is being sent to your MAC address. Most passwords would still be secure though as they should be getting exchanged using secure ...
3
The standard "old-school" way of doing this kind of thing was to have a dial-up modem that was switched off all the time except when support was needed at which point a change record would be raised for it to be enabled, the remote support person would access the modem and then at the end of the work it would be switched off again.
The manual element ...
3
"Root is God". Well, there are gods... and then, there are elder gods.
The root user can do a lot of things on a machine. In particular, he can replace the files which are used to boot the machine; thus, he can potentially replace your kernel with another of his own, which would let him pass. SELinux can be used as a way to make a declawed, neutered root ...
3
The OpenDNS updater is what keeps track of your IP address for OpenDNS. It uses this IP address to track incoming DNS requests to their service. If the updater is on your PC and you take it to work, OpenDNS will no longer be updating your HOME router IP. It will be updating your work IP. If you have other computers being used at your home you need to ...
3
It would not work very well, as far as I can see. Proxying (as well as SNAT/masquerading) requires much more than simple IP forwarding.
Let's see, say that
192.168.1.1 is your network gateway
192.168.1.2 is Alice
192.168.1.3 is Eve
192.168.2.2 is Bob.
Eve sets Alice as her gateway, and pings Bob. The packet arrives to Alice who then forwards it to the ...
3
You have three options:
install wireshark or similar on the target
monitor traffic through the network device
add your own network device that is in a position to detect the target traffic
From your own comments, options 1 and 2 are ruled out already. It may be, though, that you are precluded from the final option by your contract.
In my opinion you ...
2
This is easy to do provided you have administrative access to your network devices, and they support port mirroring . What you do is mirror the port of the end point you want to monitor, and then use a sniffing tool like wireshark, tcpdump, or snoop to record the traffic.
2
First and foremost FTP is very insecure and must never be used for authenticated file access. It is in your best interest to never use ftp and always use SFTP or FTPS. If a service provider only offers FTP, use a service provider that actually cares about their customers.
Malware will attack FTP by sniffing the network looking for authentication requests ...
2
Short answer: no.
Longer answer: If you've got coding chops, you basically need to add a new detection keyword that acts almost exactly like the threshold keyword, except it alerts for any packets after s seconds, rather than c packets within s seconds. This might be appealing if you're already building your sensors from source in your infrastructure. Not ...
2
Snort doesn't support wildcards or regular expressions on IP addresses/ranges. It does support CIDR notation for IP ranges, a few pre-configured variables in snort.conf like $HOME_NET and similar, and a ! for IP or IP range negation (edit: Oh, and of course any, but not !any).
What you could do however is to define a new ipvar variable, fill it with the ...
2
I'm assuming that what you're doing is related to ethical pen. testing. If you have no legitimate control over your target, you have 3 options
Haxoring your target: Attempt to gain access to the target machine by exploiting some vulnerabilities in the machine itself, or the operator of the machine.
Big Man in the Middle (Between your target and the servers ...
2
I just want to add an answer which I think hasn't been touched upon yet. When you connect via teamviewer to another computer, you share your clipboard with that computer (by default).
Therefore, everything you copy onto your clipboard is also copied onto the clipboard of the computer you are connected to. By installing a clipboard tracking application such ...
2
You seem to have an inaccurate impression of how networks work. Filtering doesn't require knowing what your IP address is and DNS is not an effective means of filtering content. Filters work by checking the content being requested, not where the content is being requested from. Using a DNS server that doesn't return results will stop a very basic attempt ...
2
You have a network that you want to keep isolated, but you're planning to reduce that level of isolation a little bit. I think the most important question you need to ask yourself at this juncture is: "Isolated from what?"
Let's say that you run an Internet-exposed VPN service that leads into this otherwise isolated network. That is likely to be a ...
2
Since both tmux and wemux use their own server-like process and joining/authentication procedures, they inherently increase the so-called "attack surface": that's more code which may have bugs, and bugs can easily become vulnerabilities.
However, at least tmux has good repute, with, as far as this page says, was only ever affected by one known ...
2
Yes and no.
Yes it can be traced to your ISP, ergo to the geographical area in which your ISP exists. This is more often that not where you live. But no, it can't be easily and directly traced to you.
It is required by law to provide correct information when reserving Internet resources (domain names, IP addresses), those information are stored in a ...
2
Have you thought about setting up honeypots on your network as well? They are pretty good at being able to configure ect.
http://en.wikipedia.org/wiki/Honeypot_(computing)
I have also used a few programs for VMs.
Virtual box is one of the most common free ones (windows box).
Proxmox is really common freeware that provides a lot of flexibility with ...
1
Your iptables rules look generally fine to me, although I cannot spot how you are enforcing 22 from the VPN only (unless you have configured sshd to only listen on the VPN IP, which should be ok).
Also you can use POLICY (-P) rather than your bottom two rules, but either should be fine.
1
The answers will be protocol/application dependent. Basically, if you can use a secure tunnel or a VPN solution, you will have pretty good security. Someone might be able to knock on the port, but they won't be able to connect without credentials (and certificates if you can).
You could try to setup a simple VPN using something like Hamachi, TeamViewer, or ...
1
The answer depends on why the network is isolated and whether or not allowing external access is a problem. Your network must be compliant with whatever security standards and requirements are applicable with the network connected, and presumably you only disconnect it as an added layer of safety, not as a requirement.
Also, it's worth pointing out that if ...
1
You need to be aware of (at least) the following:
If your documents are in a publicly-accessible folder, they're not private. This includes simple protections such as checking the referer, which are trivial to juke
If your documents are in a folder above the HTTP root, it is one step better; if they're encrypted and only one script can read them, even ...
1
Good question. Let's think about it this way:
You're going to take a basic maths exam and the sign on the door says
"No Masters-level students. No calculators allowed."
A normal inspector (firewall) would ask you for a student ID to make sure you're not an Masters student, then they'd let you in. A Masters student who looks just like you comes to the ...
1
The remotely (or locally-)powered router approach makes sense, but creates a way to the inside that has to be protected.
The risks of that approach is that someone learns or leaks the information about the phone number - or maybe somebody calls in by mistake (or through wardialing, à la Wargames) - and the router is left powered.
So I'd say that
the ...
1
Web Application layer Firewall like Modsecurity and Application layer filter like snort ruleset are generally signature bases rule. These rulesets are very comprehensive and covers most of application layer attacks like XSS, SQL injection. Though these firewall have support to protect against DoS through session and user level counters but this not generally ...
Only top voted, non community-wiki answers of a minimum length are eligible
