Tag Info

Hot answers tagged

40

There is really only one solution to your problem. I do note however that you're not interested in upgrading your router, so I will talk a little about that. Remember that by not upgrading your router, you are only delaying the inevitable. What will work long enough for you to get a new router: PULL THE PLUG This is honestly the best solution until you ...


23

Short version No. All you need is WPA2-AES with a custom SSID and a strong passphrase. All this assumes a "home" scenario where the AP and clients are using a PSK (preshared key). In Enterprise settings there are a couple of other attack vectors but one nice thing about a PSK is it greatly simplifies the attack surface. It pretty much comes down to the ...


16

These types of attack could be achieved via multiple CSRF attacks against the IP addresses discovered via the JavaScript reconnaissance tool. Say your local IP address is 192.168.1.100. You visit the malicious website, the JavaScript runs and finds the device 192.168.1.254 on your network. Now, depending on how complex the JavaScript is, it will either ...


15

No. You cannot make WEP uncrackable, but there are some things you may be able to do to help the problem until you get a new router. Modify the signal strength. Take off one (or more) antennas from your router (if you have a small apartment). Move your router to the center of your home. These steps may make it more difficult for a neighbor to get a decent ...


10

WEP has fundamental design flaws preventing it from ever being secure. This means that in order to get a secure network you either have to replace WEP with something secure (WPA2) or enforce security at a higher level in the protocol stack. Security at a higher level in the protocol stack means you don't allow your AP to get access to the internet. Instead ...


8

Blocking ISP access to their own device is not a clever idea. Instead just buy another router and connect between ISP's router and your computers. Then move all configuration related to your LAN to your router and configure ISP's router as bridge (or put your own router in DMZ). This way ISP will have access only to the bridge, and not to your LAN.


6

Many routers have a web-based admin console, and it sounds like that's what this attack exploits. Frequently, the admin console is only accessible on the LAN, rather than allowing external connections - and this malicious JavaScript is what's used to bridge from the attacker's machine to the LAN. One potential way that this attack could play out: ...


5

You could sniff the network for traffic and change your network configuration to an active machine(i.e. MAC address): # ifconfig wlan0 down # ifconfig wlan0 hw ether DE:AD:66:55:12:34 <== sniffed MAC # ifconfig wlan0 up assuming wlan0 is your wireless network interface. On Windows you can do something like this. Now there should be two work stations ...


5

If your network is undocumented, then you don't know what all the parts are, how they are set up, or how they interoperate. That in turn means you can't reliably do any of these crucial things: do a full risk assessment identify required controls implement those controls fully measure the controls to confirm they are working monitor the network so you can ...


4

The network you've set up uses pre-shared secret authentication. If you're already on the network, then you know the password so seeing it in plain-text isn't that much of a big deal. In most enterprise environments, they use 802.1x authentication so there's not much to be worried about. Could I access the password of wireless networks as they are ...


4

Here's how I would do that: Examine all the test descriptions from sites like badssl and Qualys SSL Server Test. Follow up on links to the actual issues being tested, read and understand the problems. Run Qualys against your server, capture the traffic using tcpdump, and examine the interactions as much as possible to understand what's going on. Set up ...


4

You've basically answered your own question. The way I see it is that an attacker can disconnect everyone, including the attacker, by performing a denial of service attack or exploit a vulnerability in the IRC daemon/server. While performing a denial of service, in theory the attacker could gain op in one or more channels by stopping the denial of service ...


4

The communication between computer goes both ways, so there can be two cases: The RAT is a server: this is the case for many well-known and legit remote access tools, like remote desktop, VNC etc... In this case, you need to allow port forwarding on your router to be able to access the computer. The RAT is a client: the tool will try to connect to a ...


4

Is this the end of malware use of DNS? No. Might tweak the landscape a little, but not hugely. It seems like the dataset in the news article could protect against both. It's useful for catching people using malware that other people have caught before. It is not useful for catching someone who sets up a burner domain just for their attack ...


4

In regards to your first question: The protocols you use will matter when leaving the VPN and going to the servers that you are trying to contact, so anyone sniffing traffic to those servers will be able to see what's being sent. In regards to your second question: If another person using EC2/Digital Ocean were able to sniff your traffic through that ...


3

Revealing the internal IP address is not always down to the proxy, sometimes the back-end is not properly configured, and its web server would "leak" system details, such as application paths and configuration details. One area that is particularly "vulnerable" to data leakage are error pages - default IIS and Apache error pages may reveal the internal IP ...


2

It's not recommended, but it's possible. Look for an option labeled TR-069 in your router, then disable it. Simple as that. TR-069 basically enables your ISP to change every* setting in your router, and disabling it disables ISP control over your router. But do take note that if your ISP has some configuration changes (very unlikely), It won't get to your ...


2

You are certainly adding risk though whether that is enough to worry about may be difficult to calculate. Is it against the terms and conditions of use of the ISP? You both could get cut off. Low to medium risk, relatively low impact. Will someone in their household do something illegal that you might end up on the hook for - because you cannot prove you ...


2

Do we have any Events code for Unix as we have in Windows. nope. what you have is a bunch of software that writes logfiles, but these logfiles do not follow any standard. If Not, On what basis can we write alerts for unix flavours or machines . for Auditing,application or network based alerts. network-based attacks are usually detected by a NIDS ...


2

The exact answer to this depends on the level of control you have over the wifi network. Assuming that you can dictate things like proxy servers, then the best option might be to install a forward proxy (something like squid) and then have that do the logging for you. If you need to know actual URLs rather than just sites, you'll need to set-up SSL ...


2

It is not a security risk if you are able to read your own WiFi key since whether you are running Windows or UNIX like operating systems, there are many ways, including through a GUI, to get it if you are connected to your hotspot at least once. If you are worried about security then you can log to your router and change the default password that comes ...


2

The difference is in the amount of information you provide to the sender of the packet. says, essentially: "No-one here. Your SYN packet went to nirvana." It provides the least amount of information to the other end. It also slows down attackers because they have to wait for a timeout. says: "Forbidden. There's someone here but they don't want to talk to ...


1

Your interpretation is incorrect. WPA2-PSK doesn't completely encrypt layer 2 information. Management frames are unencrypted (except in cases where management frame protection is implemented). MAC addresses of all communicating parties can also be observed, which somewhat helps to analyze communication flows and gain general information on the network. The ...


1

Without knowing more about your company's network layout, business model, physical access restrictions, etc... it is hard to give more than general guidance. RDP has been known to have remote execution vulnerabilities. RDP can also facilitate password attacks. So you can't look at running RDP as risk-free. It is not unheard of for companies to restrict RDP ...


1

This might be best explained by an example: patching of servers. In any decently sized network you're likely to have a myriad of servers. Some running applications, others serving as network infrastructure such as firewalls, routers and so on. All of these run a lot of software. This software is bound to have bugs from time to time. If you don't know which ...


1

Only in the early days of hacking did RATs require the lack of firewall in order for the controller to connect. Take the famous example of SubSeven -- the RAT would install, and join an IRC channel advertising a port and IP address. If the victim was behind a firewall, the machine could not be manipulated -- the hacker would just get a connection timeout. ...


1

I think it comes down to how much you trust this person. Public Wifi can be dangerous because attackers can use things like packet sniffers to detect traffic and obtain passwords and other identifying information over the same network they're in. This guy could theoretically do the same without you knowing it. Depending on the network settings you have on ...


1

Note that I am not an expert in this field, this information is gleaned from other sources. 3G Interception tools are about to appear (or may well have already done so). The "Stingray" from Harris is the most commonly quoted product and is widely used by US "law enforcement" (or maybe that should be law ignorement!) The tech blog Techdirt is a blog I ...


1

Unfortunately not the way you are thinking. But things are never simple on information security. Most of phones that I'm aware of, does not let you select a specific tower you want to connect. This is a usual GUI for Android: and the relevant ones on Engineering mode GUI: Why you want WCDMA only There are others too, but I won't add here since it's ...



Only top voted, non community-wiki answers of a minimum length are eligible