Tag Info

Hot answers tagged

14

If it's not in the same network, you most likely won't be able to. MAC addresses are hardware addresses and are usually hidden behind a router unless you are on the same network or have direct access to the device. In other words, once you leave the network, unless the device(s) in question is/are directly connected to a router you will get the MAC address ...


9

This is a timing attack and the idea (including defenses against it) has been the subject of several academic papers. The short answer to your question of "will this work and has it been used?" is "yes". Some anonymity tools / networks (not sure if TOR does this) introduce their own latency and fake packets to make it harder (see "dependent link padding"). ...


6

It is possible to find the MAC addresses of devices that are physically close to you if they have wifi enabled. When a device sends data packets over wifi they are stamped with the sender's MAC address and the destination MAC address (typically a wireless router). The contents of the packet will most likely be encrypted through WPA or WEP etc. but the MAC ...


5

By definition, if it doesn't matter if someone has access to or modifies your data, then it isn't sensitive and doesn't have to be secure. For things that have to be secure, then it is ill advised to use a custom protocol unless you can invest the huge amounts of time and resources necessary to ensure its security (millions). Note that there is also a ...


5

Most WiFi enabled devices broadcast their Mac address when probing for networks to join in the vicinity. By placing your own WiFi device in promiscuous/listening mode and utilizing a tool like Aircrack-ng, you can see and record all broadcast traffic enabling you to see if a device with a specific MAC address comes within earshot of your listening device. ...


5

For finding a wireless camera, people have long used "bug detectors" to hunt for unwanted RF transmitters and other electronic devices that unintentionally emit RF. There is no reason they wouldn't find an actively broadcasting Wi-Fi device. For a wired device, use a tone generator and detector (often called a fox and hound.) Clip the fox to the first wire ...


4

You have to make a distinction between the applicative protocol and the transport protocol. SSL/TLS is a transport protocol: it ensures some security-related guarantees (confidentiality, integrity, some authentication) for a a bidirectional stream of bytes. What these bytes mean is what the "applicative protocol" defines. E.g. in HTTPS, HTTP is the ...


4

Interesting question. Theoretically a sophisticated attacker could place hidden cameras that can't be detected, but theoretically a competent defender has logs about everything to catch attackers trying to deploy any unwanted stuff. So in this case this boils down to how sophisticated an attacker Mallory is (as it's proven that Bob isn't a competent ...


4

I suspect you answered your own question already. The mere fact that you want to protect the data implies that it is sensitive and should not be modified or leaked. If this is not the case, why bother with protecting at all? If the opposite is true (the data should be protected) then the "rule" stands that the use of custom protocols and encryption ...


2

There are different network types, but one of the most common is passively switched fiber to the street. In other words, somewhere around 32 customers share a common fiber line from the ISP. The signal from the ISP is passively split out to reach all 32 houses, so all data that is transmitted from the ISP can be received at each house. Information sent ...


2

The answer to your question seems to lie within the link you have referenced. Computer programs follow specific instructions, and in this case the ettercap filter is set to: replace("img src=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); replace("IMG SRC=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); The character string ...


2

ISP will routinely do the following for their customers: Block incoming connections on some well-known ports (e.g. port 139, the classic port for Windows file sharing). Block spam, virus and other malware sent over email. "Block" some sites by removing the DNS mappings (the customer can still access them, but the ISP DNS server will not resolve the names). ...


2

Thoughts around this: There are numeral factors that matter in such an enviroment. How much are you willing to spend on 'proper' firewalls and/or IT-security in general? Some hardware for an opensource firewall is not so much compared what can be expensive if some information gets exposed. Firewalls in general does not need to be expensive, have a look at ...


2

This is going to vary depending on your specific situation, policies you are trying to enforce, and regulatory compliance requirements. Generally, a web-app has a front-end and a back end. The front-end is responsible for handling user traffic, display/presentation of data, and authentication. The back-end is usually a database of some sort that handles ...


1

What you basically need to do is: Verify that a request is coming from an authenticated user, i.e. a user (or service) that's allowed to use your API; and Ensure a request isn't altered while in transit, commonly known as a Man-in-the-middle attack. You could install X.509 certificates on each publisher's web site and use this to authenticate them over a ...


1

TLDR: Basically with what you're asking, only ARP broadcasts, unless you subnet your wireless from your wired network. Overall it depends. First, your computer on the ethernet may occasionally send out broadcasts to the whole network. For example, if it needs the MAC address of a machine on the local network, it will send out an ARP broadcast to all ...


1

I think you're asking if a hacker could cause trouble for your home servers if you're using an insecure protocol for data. This is completely dependent on how you handle the data and how you implement parsing the information packets. If you're ONLY using the custom protocol for non-sensitive data and implementing good security practices (like blocking ...


1

Many routers - even in the consumer-segment - have basic network filtering capabilities based on protocol, port and IP, which means that they can also be used as a basic firewall. Dedicated firewall appliances often offer additional features, like deep-packet inspection to detect certain known threats on the protocol-level or automatic attack detection based ...


1

Yes, long as the user of the computer gains appropriate access to write to memory of your capturing software. The attacker could use API hooking to spoof the screenshot. http://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours Just same method used in malware and gamehacking. You'll want to ensure the user doesn't gain administrator rights and ...


1

If you're asking if a user could display an arbitrary screen, then yes. Any software that can display a full-screen image (ie: display an image not in a window, but that displays over the full real-estate of the screen) is capable of spoofing your system. Most photo editing software can do this, as can pretty much any video playback software, or even web ...


1

Using some type of network montor, network tap, ping sweep, or other traffic monitoring tool.. No, capturing traffic is generally silet unless the attacker is trying to make noise and capture the traffic. There are sys admin tools which can monitor installed programs on authorized machines, and you can use network access control to limit unauthorized ...


1

The basic rule is that on the same ethernet network, IP address spoofing is possible, usually by performing ARP spoofing. In your second scenario, computer B is completely vulnerable to computer A. Well, unless there is protection at a higher layer, e.g. using SSL. In this scenario, computer B is NOT vulnerable to computer A: Computer A --> Router -\ ...


1

It depends on what type of MitM attack you want to do. arp spoofing or any type of attack which relies upon Layer 2 will not work across routing domains. However, you can perform other attacks such as modifying a host file, DNS spoofing, or other attacks at the network level. You could attack the router itself so all traffic is directed to you, etc. You ...


1

Consider: - H uses V for all insecure/casual internet activity - H does all secure/private activity by itself (ie. banking) You may have this thought/theory inverted. On a flat line it looks like this: Host (does all secure/private activity) --> router --> internet There is no firewall mention here. Where if it were me, I would do: Host --> ...


1

No, I think V is safer than H. For H you are going for the security-through-obscurity approach, which is always discouraged. This is because, in my opinion, your assumption that attackers targetting V will not come across H is faulty. For example, most of the latest worms don't only attack a single target system but also try to discover the target networks' ...


1

This is a question of threat modelling. Which adversary are you most concerned about? Tor has the advantage of obscuring the origins of the traffic, which makes it difficult for your ISP, as well as the destinations of your traffic to track you. The adversary you should be worried about is the exit nodes. Since anyone can run an exit node, it's lucrative to ...


1

I am semi-retired from IT consulting specializing in the telecom industry. I will leave the best answer to the younger folks who work in this field. This is what I have seen lately. The answer to the question depends largely on where you are and who your carrier is. Our local carrier is a major carrier that took over another major carrier that went ...


1

From what you're describing, I'd say that the only way to achieve your goal is a credentialed audit of the server and the firewall, as opposed to network scanning from the server. The reason for this is say that outbound traffic is only allowed to a single high port on a single host, there's no way that your port scanning approach will find that. I'd ...


1

A conditional forward is SPECIFIC to a domain being queried at the end of the day. Let's model this: YOUR COMPANY yourco.com finance.yourco.com mrkting.yourco.com Internet yahoo.com google.com blogger.com Internet.Misc login.yahoo.com We have your company three websites, and a specific Yahoo site. When a machine makes a query from say your network: ...


1

The most important part of this post is "with antivirus". Do you have automatic submissions turned on? If so, those computers might have sent in an 'automatic submission' to the AV mothership at some point. It might have been flagged for evaluation, and possibly run in a controlled environment to see what behavior it would exhibit. These environments are ...



Only top voted, non community-wiki answers of a minimum length are eligible