Tag Info

Hot answers tagged

6

Typically, an eavesdropper (sniffer) will be passive -- that is they will not modify the traffic. Man-in-the-middle (MiTM) attacks usually imply an active adversary -- one who will change the contents of the message before passing it on. The two are not entirely distinct, as a MiTM may use their active attack to read the contents of messages, or simply to ...


5

Fiddler is a proxy server that runs locally on your machine. For this to work it needs to use the loopback network interface (localhost). In Windows 8 has a new runtime that allows for the running of Immersive Apps. For all Immersive Apps, Win8+ runs them in an AppContainer. All AppContainers are forbidden to use send network traffic to the localhost. ...


4

The idea of having the "quarantine" option when an antivirus detects an infected file is to avoid false positives. If by chance the antivirus software wrongly flags a file as "bad" when the file is actually something you need, like a critical program (for example Explorer.exe in Windows) such that deleting it might cause the computer to stop working, ...


4

What are the dangers of sending a file to quarantine? There is a slight possibility that the malware scanner falsely tags a valid system file as infected. Sending that file to quarantine could render your system unusable until the file is restored. This has happened on occasion with some major vendors of antivirus for a specific release of definitions. ...


4

If you are on unsecured WiFi, all of your internet traffic is broadcasted for everybody nearby to see. This means that any traffic to/from your computer that is not encrypted at another layer (such as SSL/TLS or SSH) will be visible, which can expose sensitive data, such as usernames and passwords, or authentication cookies. In addition to passive ...


3

The first step in securing anything should be to evaluate what you need to secure and where somebody might attack you (attack surface). I don't know what you have to protect, but since you are doing your computing in the cloud you should not only ask yourself how to communicate with your cloud application, but how the application itself is secured, that is ...


3

I would say a malicious internal actor. Internal actor meaning that he is validly participating in the network, but malicious indicating he's abusing the system.


3

Users of applications cannot. They can only try to not have rogue apps running on their systems. In this case we have an app that is normally harmless or even (attempts to be) beneficial unless it detects you're approaching a juicy login. Some, each alone insufficient, ways of "protecting": do not install untrusted apps or from untrusted sources. pay ...


2

Your first priority: repression. Make sure that your security is tight and no more information is leaked. Second priority: repair. Don't try to fight the criminal yourself. Go to the police and report a crime. Most police forces have a digital forensic team that can do the things needed. Let's just hope that they have the time/resources/priority to look ...


2

There's no good way to restrict accounts based on network interface in Linux (by the time a packet reaches a layer that understands the concept of "account", it's forgotten which interface it came in on). However, there are two easy ways to restrict access to an application based on which interface is used: At the OS level, the iptables firewall has ...


2

To answer your question:goldenticket.disconnect.me You probably have adblock add-on installed in your chrome brower


2

The difference is exactly the same as the language suggest. "Shared key" means that the same key is used by several party. It doesn't tell you how the key was distributed among them. "pre-shared key" means the key has been shared before the current operational context. To go you two examples: When you perform a Diffie-Hellman key exchange in an SSL ...


2

It's sort of like asking the difference between a car and steering. When you are driving a car, you can (and probably should!) steer it. But you can steer a bike too... Enough with the analogy, the difference, in my view, is that MitM is a class of attack and the sniffing is simply the word for analyzing packets on the network (and often just the packets ...


2

A sniffing attack is a attack on confidentiality. It can be via a span port on a switch, processes on servers through which the traffic passes, on the end user client. Sniffing is often an MITM attack but it is passive. A MITM attack is typically a more active attack where the traffic route has been altered to include the adversary, such as a rogue access ...


1

1. Protect the server from getting hacked For this you could find multiple hardening guides, which combines locking down your machine, keeping it up to date with hotfixes and so on. 2. the data stored on the server should be encrypted Ensure your data is encrypted, you could do this using symmetric encryption (you suggested AES, with the key being a ...


1

In the Information Security world, internal attacks or inside malicious attacks are known as Insiders. Someone who can poke, sniff and even can do anything with a trusted identity is an Insider and can install malwares and anything bad.


1

For me, insider attacks and internal attacks perfectly fit your description. If you want to find a more specific name maybe try to be more specific on what kind of malicious activities the node is carrying out in the network. The paper [1] is from the field of wireless sensor network (WSN) security. A WSN is a distributed system of sensor nodes. There are ...


1

Normally we call that kind of attack "spoofing". It usually implies that there's some kind of active interaction involved, whereas sniffing is passive.


1

What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers. You can confirm this by disabling the proxy server. If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure. You can reset the DNS server settings to what ...


1

Shelloid Virtual Private Transport (VPT) enables you to grant service access without yielding network access like VPNs. You can simply share the service when you need it and unshare it afterwards (once our APIs are in place you can write a cron job to do this automatically). VPT is open source (http://shelloid.org). Disclaimer: I am the founder of Shelloid ...


1

This is not really an information security question, but I'm sure you'll find this is addressed in the Quora terms of service: http://www.quora.com/about/tos crawling the Service is permissible in accordance with these Terms, but scraping the Service without the prior consent of Quora except as permitted by these Terms is expressly prohibited; In ...


1

It is possible to fingerprint the OS to some level, but you won't be able to differentiate Kali Linux from Ubuntu/Red Hat. Or between some Windows versions. On the other hand detecting the behavior (eg. a port scan) instead of the OS would be simpler. If you are happy with the detection quality and don't mind some false positives, eg. that your boss new ...


1

WAN or LAN? would exposing just 80 or 443 still compromise the security? Yes it would - there could be numerous vulnerabilities in the web app that an attacker could use to gain control of it. Can a hacker push bots or take control of the server and in turn reach the internal network? Yes, once they have control of the web server they might be ...


1

Passive methods analysing traffic that comes into a single system are unlikely to work for you unless you have a very small network topology. Using tools like P0f or OSSIM you will learn what other subnets exist, but only if they connect to your box. You won't learn where they are in relation to each other, or even necessarily get a full picture of all the ...


1

I agree with the rest of the posts saying that a malware is not dangerous if quarantined and if it stays in the quarantine. But I'd like to add a qualifier - this is only true if the software works as intended. Antivirus software, just like any other software out there, especially software that has loads of code to parse untrusted data is bound to have ...



Only top voted, non community-wiki answers of a minimum length are eligible