New answers tagged

0

There are two ways on how to run an IDS: to detect attack attempts to detect successful attacks The mode is defined by the rules which are enabled. In most environments, like yours, there is no clear strategy which leads to having both kinds of events triggered. If you want to detect possibly successful attacks only (and ignoring attempts which are not ...


0

It means the access point is a hidden station which means it does not send any beacons. Airodump knows of the network existence and it's SSID because the clients did revealed it. This is why a hidden station isn't a secure one. As soon as a client is connected at least the BISSD is visible to everyone with a card in monitor mode.


-1

The short answer - yes and yes. It's been done before by governments by breaking into ISP infrastructure, wiretapping at traffic aggregation points etc (just say smth about terrorists or child porn and you're free to break any law you want). The longer answer about GSM: all the means of "over the air" interception I now of can be (in theory) detected by ...


0

If you're trying to get the MAC address of Wi-Fi access points, you can run sudo iwlist scanning, and look for the ESSID of the device that interests you.


0

As MadWard 4 mentioned you can't decrypt the SSL without the private key but sadly most of the IoT devices out there don't use encryption so depending on your device you may in fact be able to see everything anyway and if nothing else you can learn things about where the device is communicating to and its frequency of communication even if SSL is present. ...


2

If I understand your scenario correctly: You're talking about a security mechanism that relies on signatures made by 1024-bit RSA keys. You have a relatively easy way of deploying updated certificates and revoking the old ones. It's a matter of days, maybe months, but certainly not years. The public record for breaking RSA is a 768-bit key. Nation-states ...


1

Warning: This answer is pure speculation. It is also hard to get references for covert programs, but I've linked to Wikipedia pages which have some good references. I've also stayed away from examining WhatsApp's implementation, as there are several other Security SE posts discussing various aspects of it. I hope I have matched your scenario correctly in ...


1

This would be no different in design from TOR where your data is forwarded through nodes. There needs to be a separation of things here. First I will speak on "inference" which is what the government would aim for. Imagine there are a dozen in the group you speak of. The keyword is "apples" User1 --> "I will smash all apples" --> group Random Group ...


1

First and foremost, Qualys probably alerts you because as of January 1, 2014 the Certification Authority/Browser (CA/B) Forum required that certificates issued after this time frame MUST be at least 2048-bit key length. The answer to your question comes down to a administrative decision about what risk the company is willing to take/assume. Starting with ...


3

You should not deploy your own encryption scheme for this, neither share symetric keys with multiple parties. To protect data on transit between each client and the server, you should use TLS to protect those connections. TLS will take care of symetric key agreement and encryption decryption to each client the right way, avoiding many many things you are ...


-1

This thing should be simple. First you need a crypto library like openssl. If there is a registration phase, you could have the clients generate a pair of private/public keys, (DH or RSA, using openssl) then announce the public part on the server, also called client certificate. And that's it. On every new client-server connection, a symmetric key ...


1

What makes you believe it is not executing properly? Many variants of malware have checks and balances that disable full execution if certain programmed parameters are not met for example: Check if I am virtualized if so don't run Check to see if I have true Internet connectivity if not don't run Check to see if I can exploit anything on this machine for ...


1

There are actually 3-4 questions in your post, and they can mostly be answered with just networking answers. if I spoof the "source" IP to an IP of the segment 172.16.x.x, will spoofing work? It depends what you mean by "work", but the principle of spoofing is to fake packet and see what happens. You can fake what you want, the idea will be then to ...


0

I can think of a few things to look out for in your situation. You can potentially get infected on your win 10 machine not just by running a malicious .exe file but also by opening any malicious file. MS Office or PDFs etc have the potential to be just as dangerous. (Of course this does require user action.) If the laptop is infected and remote access ...


1

An attacker could know how are yours net devices and search vulnerabilities from them, if you use SNMPv2, you should be careful to permit only read access.


1

SNMP enables an attacker to paint the same graph you are painting. "These are the mission critical systems they're worried about. They must be if they're being monitored." Whenever I see SNMP during pentests, I get happy since it minimizes the amount of time I spend looking for this. SNMP has enabled me to find networks I would have otherwise not discovered, ...


0

I am assuming when you ask whether WPA-Enterprise is more secure than WPA2, you mean WPA2-PSK (aka WPA-Personal). This is a bit like asking are vegetables healthier than an apple. WPA-Enterprise covers a spectrum of authentication methods (about 100 of them all under the extensible authentication protocol), some very strong, some very weak. WPA2-PSK is a ...


3

Who can view what you are doing? You, anyone that uses the same router (assuming you're not in Access Point isolation mode), anyone that has access to the router's access logs, possibly including the person that set up the router, and the Internet Service Provider. WPA prevents other people without access to the router from viewing your data casually from ...


0

Yes, it is possible. Hacking the WiFi is the hard part and would most likely not be the method used. Unless you have a real easy to guess password like a name, place, commonly used words. Most likely way would be from your computer, if you have a back door or virus on your PC, then someone could monitor everything. Who else has access to your PC, another ...


2

Contrary to a common misconception, the network key is not the encryption key. The WiFi communication is encrypted on its own using a key exchange protocol. This makes it impossible for anyone without abnormally huge processing power to decrypt anything that goes through. That said, if the person controls the router, that changes things as the router ...


-1

Found a script called "mass-deauth" https://github.com/m33b0/mass-deauth


0

As far as I know and understand the principle of VLANs there is no security risk by the protocol / device itself. By that I mean that VLAN are meant to segregate Layer2 unicast domains thus no, if properly configured VLAN_A and VLAN_B should not be able to talk to each other. All things being equal if you put user on a trunk there is no reason they should ...


0

Whether you use one, two or a dozen servers to handle the task, the bandwidth between the client(s) and the server(s) will remain the same. The only part you can control is the way your server responds to invalid requests or to massive amounts of requests. One way it could be implemented is by using fail2ban and a firewall on the server. This way your UDP ...


0

It looks like you want to consider Data Loss Prevention tools (https://en.wikipedia.org/wiki/Data_loss_prevention_software). However before you go straight to the technology solution, you have to understand what "normal" file access looks like. If you do not know what that looks like it becomes impossible to know what abnormal looks like. This is ...


3

Each production IP address has a unique hostname, which is predictable, consistent, deterministic, and entirely useless to anyone but a few engineers who I suspect can read these addresses like a map. These names matter a lot to those people; but for the rest of us we just care that it doesn't create new problems. That's where the XSS comes in, because ...


143

This sounds like the behaviour of an uptime service. These connect from multiple locations at a regular interval, and are designed to alert the server owner in the event of problems. In this case, it looks like the server owner had set up such a service, and then forgotten about it, since the server didn't have any problems - the alerting service wouldn't ...


1

I suspect the security aspect (their second reason) is related to 1e100.net simply being different from the product domains (youtube.com, blogger.com, google.com). The fact that all servers identify by the same hostname is nice for simplicity (their first reason), but probably not significant for security. I'm not sure exactly what the threat profile is ...


1

Like Stephane, I agree it can help your security, but it's go with an example: Let's say you have your "user data" somewhere in your application, that holds email addresses, usernames, and passwords. (Probably in a DB) You could create two DB accounts. One account is called "Nobody" and the other is called "Admin". "Nobody" is used by your normal site, ...


21

Yes, it's a good idea: if you application allows it, it will make it possible to apply the principle of least privilege to a deployment, for instance by making sure the administrative interface can only be reached from "secure" networks. It can be further improved by applying the same principle all over the stack: using the OS and database security systems ...


0

ARP Spoofing is mostly the basis of MitM Attacks. It is used to redirect the traffic initially. This is done by fooling the victim into beliving that your mac address is associated to the routers ip address. This is called ARP-Spoofing or ARP-Cache poisoning. DNS Spoofing is used to target specific sites. For example if you created a fake site that is ...


2

To answer the subject line question, "Is promiscuous mode sufficient to sniff packets in a wifi network?", the answer is yes, catching the packets just requires a network adapter that can be put into "monitor" or "promiscuous" mode, ie both modes work...that part isn't that hard. (You mentioned both modes in your edit) This is assuming you are using a NAT ...


0

DDoS attacks' goal is to exhaust some of your resources (bandwidth, CPU, RAM, disk, ...). They are usually of two kind: exploit a vulnerability on your server (or backend) which impact a resource with a small effort (ressource wise) on the attacker side. Sloworis is such an example. The solution is usually a fix from the vendor. exploit the fact that you ...


-1

That is exactly why having a public UDP service is extremely touchy and risky. If it represents any cause of worry before implementation, you can be 100% sure that it will be a thousand times worse when it gets live. The only ways you could deal with such a service are: with a subscription white list; the end user that needs the service signs-up and ...


0

This question at Stack Overflow is nominally asking the same thing. You can use the URL Rewrite module to do your filtering by adding a condition around the {HTTP_X_FORWARDED_FOR} variable as described in this answer. Alternatively, the other answer describes a method by which you can set the IP address back to its pre-proxy value with a global rewrite ...


3

This is the job of a host-based firewall. While IP based rules are so integral to the system that the built~in GNU/Linux Firewall is named Iptables and the basic slement of a firewall is a list of rules (called a chain) that could easily handle whatever packets of the type you describe that aren't handled back at the hardware router/firewall ip layer, I have ...


1

Jan Doggen is right: just writing an email which explains the steps to reproduce the bug, the expected result, and the actual result is enough. If you want a slightly more structured format, I suggest you to take a look at the Facebook bug report form and to read these Google guides. If you want to be more accurate when describing the impact, you could ...


0

If a website has a bug, just write them a mail saying that you think you might have found one. Report what you did exactly, what was the expected result, what was the actual result. Adding some screenshots will help. How they react is nothing to worry about. A website with high quality standards (for the site and their service) will either inform you that ...


2

Assuming the routers you are using have stateful access lists then they can be used as basic network firewalls and the design you have will provide some very basic defense in-depth benefits. If it's a possibility you may want to block all inbound packets initiated by the Free-BSD server entering the second router (clients behind the second router can still ...


0

Since you have freebsd, you can use ipfw for firewall usage. Though, if you understand how breaches work, they don't start from the outside in, they're mostly inside out. Firewalls can stop outside scanning to internal networks, but internal hosts get compromised and that is a different kettle of fish.



Top 50 recent answers are included