Tag Info

New answers tagged

1

A conditional forward is SPECIFIC to a domain being queried at the end of the day. Let's model this: YOUR COMPANY yourco.com finance.yourco.com mrkting.yourco.com Internet yahoo.com google.com blogger.com Internet.Misc login.yahoo.com We have your company three websites, and a specific Yahoo site. When a machine makes a query from say your network: ...


0

Only if you distrust the other users of your home network. I mean, kids these days, one minute you're teaching them to ride a bicycle, the next they're poisoning your ARP cache and sniffing your traffic.


1

TLDR: Basically with what you're asking, only ARP broadcasts, unless you subnet your wireless from your wired network. Overall it depends. First, your computer on the ethernet may occasionally send out broadcasts to the whole network. For example, if it needs the MAC address of a machine on the local network, it will send out an ARP broadcast to all ...


0

Yes. Regardless as to whether or not the victim is hooked up to the router via Ethernet cable or WiFi, it's still connected to the same router - sharing what's obviously known as the same LAN. Being on the same network makes it very easy for the attacker to utilize tools such as BackTrack, a distribution of Linux, to use command line functions, suites, and ...


0

Most sniffing (sometimes called passive sniffing) happens when I read signals that weren't intended for me. I can read them because you don't shoot your signals to a router like a beam, you just kind of emanate them in all directions and hope the router picks up. The important thing about passive sniffing is that it's undetectable - you can't see or control ...


-1

Depends on Lan, but if you talking about home router(dlink, asus, linksys, etc) based lan. I would say Yes it adds security.(but highly depends on your use case) Recent years there was a lot vulnerabilities in routers found, and if you did't flashed router for long time you at risk. As example 'The Moon' worm infects Linksys routers So router is one of first ...


2

Although it indeed adds some crypto to your LAN communication, in the case of a home user there is generally no benefit from doing it. Furthermore, that would generate bandwidth and resources overrun.


1

The most important part of this post is "with antivirus". Do you have automatic submissions turned on? If so, those computers might have sent in an 'automatic submission' to the AV mothership at some point. It might have been flagged for evaluation, and possibly run in a controlled environment to see what behavior it would exhibit. These environments are ...


0

If it's not anything registered it might very well be a UPnP vulnerability. In this case, a device on a LAN is infected (e.g. a "smart" TV), opens port 17275 on the home router via UPnP (see this answer) and waits for a connection. I'd suggest setting up a honeypot on that port and listen for what comes in for a starter. The nice folks at SANS' ISC might ...


1

I think you're asking if a hacker could cause trouble for your home servers if you're using an insecure protocol for data. This is completely dependent on how you handle the data and how you implement parsing the information packets. If you're ONLY using the custom protocol for non-sensitive data and implementing good security practices (like blocking ...


4

You have to make a distinction between the applicative protocol and the transport protocol. SSL/TLS is a transport protocol: it ensures some security-related guarantees (confidentiality, integrity, some authentication) for a a bidirectional stream of bytes. What these bytes mean is what the "applicative protocol" defines. E.g. in HTTPS, HTTP is the ...


5

By definition, if it doesn't matter if someone has access to or modifies your data, then it isn't sensitive and doesn't have to be secure. For things that have to be secure, then it is ill advised to use a custom protocol unless you can invest the huge amounts of time and resources necessary to ensure its security (millions). Note that there is also a ...


4

I suspect you answered your own question already. The mere fact that you want to protect the data implies that it is sensitive and should not be modified or leaked. If this is not the case, why bother with protecting at all? If the opposite is true (the data should be protected) then the "rule" stands that the use of custom protocols and encryption ...


2

ISP will routinely do the following for their customers: Block incoming connections on some well-known ports (e.g. port 139, the classic port for Windows file sharing). Block spam, virus and other malware sent over email. "Block" some sites by removing the DNS mappings (the customer can still access them, but the ISP DNS server will not resolve the names). ...


0

You can easily set your up address as static and then change your Mac address to match that of the real hardware at that ip but I have not tried this and dont know how it would work in practice.. could create some interesting results when it comes to port jacking etc.


1

Absolutely. One way to go would be with ARP spoofing. It can be used to put your node as a gateway for the network.


0

Funny you ask that, I've been doing tests on that and the only thing I was able to spoof was the mac-address in Linux Backtrack such that I was able to tell my switch that I am another PCs mac address but NOT IP address such that I could see all the data being sent to the other PC and go on undetected (Man in the middle attack). You can however mask your ...


2

Thoughts around this: There are numeral factors that matter in such an enviroment. How much are you willing to spend on 'proper' firewalls and/or IT-security in general? Some hardware for an opensource firewall is not so much compared what can be expensive if some information gets exposed. Firewalls in general does not need to be expensive, have a look at ...


1

Many routers - even in the consumer-segment - have basic network filtering capabilities based on protocol, port and IP, which means that they can also be used as a basic firewall. Dedicated firewall appliances often offer additional features, like deep-packet inspection to detect certain known threats on the protocol-level or automatic attack detection based ...


1

Yes, long as the user of the computer gains appropriate access to write to memory of your capturing software. The attacker could use API hooking to spoof the screenshot. http://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours Just same method used in malware and gamehacking. You'll want to ensure the user doesn't gain administrator rights and ...


-3

First option is wrong because you will turn the firewall into a router, and firewalls should not be routers. Second option is good, but you can add that second firewall to the internet, but keep the DMZ on the internal Firewall. DC


0

Yes, that sounds quite spoofable. Take some screenshots of usual activity at the appropriate delay, then have something display the next one every time a screenshot is taken. Apart from that, it depends on the privileges the user has, and on what you mean by “suspicious activity”. A USB stick preloaded with anything and masquerading as some document, for ...


0

You are looking for the IEEE public OUI database: https://standards.ieee.org/develop/regauth/oui/public.html With the vendor identified you can then zero in on the actual product.


1

If you're asking if a user could display an arbitrary screen, then yes. Any software that can display a full-screen image (ie: display an image not in a window, but that displays over the full real-estate of the screen) is capable of spoofing your system. Most photo editing software can do this, as can pretty much any video playback software, or even web ...


1

Using some type of network montor, network tap, ping sweep, or other traffic monitoring tool.. No, capturing traffic is generally silet unless the attacker is trying to make noise and capture the traffic. There are sys admin tools which can monitor installed programs on authorized machines, and you can use network access control to limit unauthorized ...


0

You can always look for those Wifi and Ethernet cards which are in promiscuous mode as these shouldn't be so. If you deploy a good AV like sophos you can block all USB ports and CD drives. Lock down privileges to certain things such as CMD, Run and maybe C:. If you deploy a proxy you can filter the undesired website into a blacklist so the user cannot reach ...


3

There is no way to do that unless you can monitor the installed programs on your users´ PCs with a software like EMCO Software scanner.


0

Not for nothing, but OS X 10.6.x+ will allow you to connect to multiple IPSec VPNs at once. As for passing ALL traffic through a VPN tunnel, yes, this is the default behavior, although Cisco (and I'm certain the same exists for other vendors such as Juniper, etc.) has a technique called "split-tunneling" where only some of your traffic is passed through the ...


1

The best alternative will be quantum locking of communications in peer to peer sessions but it is still developing, extremely expensive, has distance limitations for now


5

For finding a wireless camera, people have long used "bug detectors" to hunt for unwanted RF transmitters and other electronic devices that unintentionally emit RF. There is no reason they wouldn't find an actively broadcasting Wi-Fi device. For a wired device, use a tone generator and detector (often called a fox and hound.) Clip the fox to the first wire ...


0

The Wifi Positioning System tells where you are by seeing what wireless access points are visible, looking up their assumed locations in a database, and calculating the most likely position for the WPS antenna. In theory, WPS doesn't require an Internet connection to tell where you are. If the device comes pre-loaded with a database of AP locations, it can ...


2

Bob could sniff the traffic. Bob could search the house again. Bob could use lsof -i:49152 to check what program is running on this port if he can access the PC. Bob could ask Mallory if she's kidding because this is annoying


4

Interesting question. Theoretically a sophisticated attacker could place hidden cameras that can't be detected, but theoretically a competent defender has logs about everything to catch attackers trying to deploy any unwanted stuff. So in this case this boils down to how sophisticated an attacker Mallory is (as it's proven that Bob isn't a competent ...


0

You could always set up a honeypot in conjunction with not broadcasting your SSID (service set identifier). An attacker would not know the real AP exists, thus attack the honeypot which you can log to varying degrees based on how much knowledge you have. A simple google search will wield you with many tools. MAC address filtering is a good security feature ...


0

There's no one (normal) process that would be causing ARP to happen - a process might ask for a connection to an IP address, but then it's the network stack's job to figure out how to get it to another machine, and that's when ARP happens. Your best bet is to figure out where the machine is connected, switchport wise, from your switch. Either via the ...


9

This is a timing attack and the idea (including defenses against it) has been the subject of several academic papers. The short answer to your question of "will this work and has it been used?" is "yes". Some anonymity tools / networks (not sure if TOR does this) introduce their own latency and fake packets to make it harder (see "dependent link padding"). ...


1

https://prism-break.org/en/all/#video-voice This is a list of alternatives to Skype, all of which are encrypted.


2

This is going to vary depending on your specific situation, policies you are trying to enforce, and regulatory compliance requirements. Generally, a web-app has a front-end and a back end. The front-end is responsible for handling user traffic, display/presentation of data, and authentication. The back-end is usually a database of some sort that handles ...


0

If the system runs the sniffer, its interface will be in promiscuous mode. The test works like this: Send a ping with the correct IP address into the network but with a wrong mac address. The sniffing host will answer the ping packet, as it will receive every packet in promiscuous mode. There is a ready-to use script in nmap to support this detection. ...


5

Most WiFi enabled devices broadcast their Mac address when probing for networks to join in the vicinity. By placing your own WiFi device in promiscuous/listening mode and utilizing a tool like Aircrack-ng, you can see and record all broadcast traffic enabling you to see if a device with a specific MAC address comes within earshot of your listening device. ...


6

It is possible to find the MAC addresses of devices that are physically close to you if they have wifi enabled. When a device sends data packets over wifi they are stamped with the sender's MAC address and the destination MAC address (typically a wireless router). The contents of the packet will most likely be encrypted through WPA or WEP etc. but the MAC ...


14

If it's not in the same network, you most likely won't be able to. MAC addresses are hardware addresses and are usually hidden behind a router unless you are on the same network or have direct access to the device. In other words, once you leave the network, unless the device(s) in question is/are directly connected to a router you will get the MAC address ...


0

Honestly, the best solution I have used is Core Impact, but it doesn't come cheap. Of course there is always BackTrack, which includes most of the tools you'll need and is completely free. However, I would say that in almost all cases a one stop solution will not fit all situations and its best to have a wide and varied tool set. I would suggest always ...


2

The answer to your question seems to lie within the link you have referenced. Computer programs follow specific instructions, and in this case the ettercap filter is set to: replace("img src=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); replace("IMG SRC=", "img src=\"http://www.irongeek.com/images/jollypwn.png\" "); The character string ...


1

The basic rule is that on the same ethernet network, IP address spoofing is possible, usually by performing ARP spoofing. In your second scenario, computer B is completely vulnerable to computer A. Well, unless there is protection at a higher layer, e.g. using SSL. In this scenario, computer B is NOT vulnerable to computer A: Computer A --> Router -\ ...


1

It depends on what type of MitM attack you want to do. arp spoofing or any type of attack which relies upon Layer 2 will not work across routing domains. However, you can perform other attacks such as modifying a host file, DNS spoofing, or other attacks at the network level. You could attack the router itself so all traffic is directed to you, etc. You ...


0

Computer A needs to control a device which handles Computer B's traffic on order to perform a MiTM attack. In your top scenario there's a bigger attack surface because there are 2 routers that computer A can attempt to compromise.


1

Consider: - H uses V for all insecure/casual internet activity - H does all secure/private activity by itself (ie. banking) You may have this thought/theory inverted. On a flat line it looks like this: Host (does all secure/private activity) --> router --> internet There is no firewall mention here. Where if it were me, I would do: Host --> ...


1

No, I think V is safer than H. For H you are going for the security-through-obscurity approach, which is always discouraged. This is because, in my opinion, your assumption that attackers targetting V will not come across H is faulty. For example, most of the latest worms don't only attack a single target system but also try to discover the target networks' ...


0

Keep in mind that any non-HTTPS web traffic running through TOR passes the exit-node in clear-text. The same problem applies to your ISP, but you know your ISP and you know they are bound to certain laws regarding privacy and confidentiality. But you don't know who your exit node is and what agenda they could be following. For that reason you should be very ...



Top 50 recent answers are included