Hot answers tagged

142

This sounds like the behaviour of an uptime service. These connect from multiple locations at a regular interval, and are designed to alert the server owner in the event of problems. In this case, it looks like the server owner had set up such a service, and then forgotten about it, since the server didn't have any problems - the alerting service wouldn't ...


21

Yes, it's a good idea: if you application allows it, it will make it possible to apply the principle of least privilege to a deployment, for instance by making sure the administrative interface can only be reached from "secure" networks. It can be further improved by applying the same principle all over the stack: using the OS and database security systems ...


16

The HSTS header stops MitM attacks by instructing the browser to always send HTTPS (as opposed to HTTP) request to the domain until the policy expires. So a browser that respects the header would send a request to https://example.com even if the user clicked a link to http://example.com. The logic behind HSTS has not changed since it was defined in an RFC ...


8

SSLStrip worked rewriting https requests to plain http, removing the protection and allowing both eavesdropping and modification. A server with HSTS protection will set a header on a HTTPS request asking the browser to only contact that server using HTTPS: Strict-Transport-Security: max-age=31536000 In this case, for one year the browser will only ...


3

You should not deploy your own encryption scheme for this, neither share symetric keys with multiple parties. To protect data on transit between each client and the server, you should use TLS to protect those connections. TLS will take care of symetric key agreement and encryption decryption to each client the right way, avoiding many many things you are ...


3

Each production IP address has a unique hostname, which is predictable, consistent, deterministic, and entirely useless to anyone but a few engineers who I suspect can read these addresses like a map. These names matter a lot to those people; but for the rest of us we just care that it doesn't create new problems. That's where the XSS comes in, because ...


3

Who can view what you are doing? You, anyone that uses the same router (assuming you're not in Access Point isolation mode), anyone that has access to the router's access logs, possibly including the person that set up the router, and the Internet Service Provider. WPA prevents other people without access to the router from viewing your data casually from ...


3

This is the job of a host-based firewall. While IP based rules are so integral to the system that the built~in GNU/Linux Firewall is named Iptables and the basic slement of a firewall is a list of rules (called a chain) that could easily handle whatever packets of the type you describe that aren't handled back at the hardware router/firewall ip layer, I have ...


2

I know a few like: Pwn Pro Secpoint Penetrator But I don't know the exact generic name of those devices and I don't think there is one.


2

Assuming the routers you are using have stateful access lists then they can be used as basic network firewalls and the design you have will provide some very basic defense in-depth benefits. If it's a possibility you may want to block all inbound packets initiated by the Free-BSD server entering the second router (clients behind the second router can still ...


2

Contrary to a common misconception, the network key is not the encryption key. The WiFi communication is encrypted on its own using a key exchange protocol. This makes it impossible for anyone without abnormally huge processing power to decrypt anything that goes through. That said, if the person controls the router, that changes things as the router ...


2

To answer the subject line question, "Is promiscuous mode sufficient to sniff packets in a wifi network?", the answer is yes, catching the packets just requires a network adapter that can be put into "monitor" or "promiscuous" mode, ie both modes work...that part isn't that hard. (You mentioned both modes in your edit) This is assuming you are using a NAT ...


2

If I understand your scenario correctly: You're talking about a security mechanism that relies on signatures made by 1024-bit RSA keys. You have a relatively easy way of deploying updated certificates and revoking the old ones. It's a matter of days, maybe months, but certainly not years. The public record for breaking RSA is a 768-bit key. Nation-states ...


1

First and foremost, Qualys probably alerts you because as of January 1, 2014 the Certification Authority/Browser (CA/B) Forum required that certificates issued after this time frame MUST be at least 2048-bit key length. The answer to your question comes down to a administrative decision about what risk the company is willing to take/assume. Starting with ...


1

What makes you believe it is not executing properly? Many variants of malware have checks and balances that disable full execution if certain programmed parameters are not met for example: Check if I am virtualized if so don't run Check to see if I have true Internet connectivity if not don't run Check to see if I can exploit anything on this machine for ...


1

There are actually 3-4 questions in your post, and they can mostly be answered with just networking answers. if I spoof the "source" IP to an IP of the segment 172.16.x.x, will spoofing work? It depends what you mean by "work", but the principle of spoofing is to fake packet and see what happens. You can fake what you want, the idea will be then to ...


1

An attacker could know how are yours net devices and search vulnerabilities from them, if you use SNMPv2, you should be careful to permit only read access.


1

SNMP enables an attacker to paint the same graph you are painting. "These are the mission critical systems they're worried about. They must be if they're being monitored." Whenever I see SNMP during pentests, I get happy since it minimizes the amount of time I spend looking for this. SNMP has enabled me to find networks I would have otherwise not discovered, ...


1

Jan Doggen is right: just writing an email which explains the steps to reproduce the bug, the expected result, and the actual result is enough. If you want a slightly more structured format, I suggest you to take a look at the Facebook bug report form and to read these Google guides. If you want to be more accurate when describing the impact, you could ...


1

I suspect the security aspect (their second reason) is related to 1e100.net simply being different from the product domains (youtube.com, blogger.com, google.com). The fact that all servers identify by the same hostname is nice for simplicity (their first reason), but probably not significant for security. I'm not sure exactly what the threat profile is ...


1

Like Stephane, I agree it can help your security, but it's go with an example: Let's say you have your "user data" somewhere in your application, that holds email addresses, usernames, and passwords. (Probably in a DB) You could create two DB accounts. One account is called "Nobody" and the other is called "Admin". "Nobody" is used by your normal site, ...


1

An application proxy (or more commonly called application level gateway) is a firewall at the application level. A packet filter is a firewall at the packet level. This mean with a packet filter you are not able to filter web traffic for malware since it has no understanding of the applications protocols of the web (i.e. HTTP). An application level gateway ...


1

You are taking the wrong approach here. The purpose (the initial true purpose) of a honeypot as defined by Lance Spitzner was to trap someone inside of a system that seemed to be filled with enough goodies that the attacker would waste time there, giving admins enough time to prevent them from doing damage elsewhere, while studying them. The first open ...


1

Warning: This answer is pure speculation. It is also hard to get references for covert programs, but I've linked to Wikipedia pages which have some good references. I've also stayed away from examining WhatsApp's implementation, as there are several other Security SE posts discussing various aspects of it. I hope I have matched your scenario correctly in ...


1

This would be no different in design from TOR where your data is forwarded through nodes. There needs to be a separation of things here. First I will speak on "inference" which is what the government would aim for. Imagine there are a dozen in the group you speak of. The keyword is "apples" User1 --> "I will smash all apples" --> group Random Group ...



Only top voted, non community-wiki answers of a minimum length are eligible