Tag Info

New answers tagged

2

You could think of Quantum Cryptography as a form of cryptography at the physical level. Quantum Cryptography uses the properties of quantum mechanics to send messages that can't be intercepted by a 3rd party. It's not cryptography in the strictest sense, but it serves the same purpose of preventing 3rd parties from intercepting data. Of course, it ...


1

The job of physical layer is to transmit the data over some channel(cable or wireless medium). If encryption was done at the physical layer, then all the data, including the application data, the destination IP address, port number, different headers, etc. will be encrypted as well. When this encrypted data will be transmitted, the next node(router,switch, ...


0

The data link layer is the lowest layer where actual data is exchanged, the physical layer immediately below that is the mechanism for passing that data. You could insert an encryption layer in between your physical layer and your data link layer that flips bits on the wire in a manner that a device at the other end would be able to decode, but really all ...


0

Basically, he can TRY to attack you. This is usually worse than it sounds. Basically, he has the opportunity to exploit any outdated software, weak passwords (or default passwords - not many people change the password on their router), or bad ideas you might have. By default, your modem stops people outside your LAN from trying to do most of that (except for ...


2

The Modem is connected to my PC. What can he possibly do while he's on my internet? This is a very subjective question because it depends on some many things, but permit to build two scenarios. Best case: He checks his e-mails, read his favourite newspaper and nothing happens to you from a security perspective. Worst case: He has thousand of ...


2

I have read somewhere that it could be dangerous to use unknown networks When one mentions "unknown networks", it usually means some public networks like cybercafe, airports, and other public places. As long as you are speaking with your home, then the network is known because you have access to all configuration and under normal circumstances all ...


2

The router cannot open ports in your computer since the OS is the only responsible to manage it. A software firewall can mitigate some risks, however you are still exposed to the following when connecting to an unknown network: All traffic not encrypted can be easily sniffed You are exposed to DNS related attacks being redirected to malicious websites Man ...


4

Just to add on, _optout_ can be added anywhere in the SSID not necessarily at the end. However, Google's _nomap has to be placed at the end. Yes, 802.11x will networks will not be shared through WiFi sense. Official source: Microsoft WiFi sense FAQ. Look under "I'm concerned about sharing Wi‑Fi networks. Can you tell me a little more?" Theoretically, ...


0

There are generally 2 reasons to have a management vlan: To provide security and control for management interfaces To provide a redundant way to access critical systems so if the core network has problems there is another way to access management interfaces in order to restore services I would usually recommend that the management network be on a ...


0

FWbuilder might be of interest to you http://www.fwbuilder.org/ This is a GUI tool to help you configure and distribute (i.e. push) firewall configurations for various firewall implementations. It 'compiles' network access rules and firewall configuration options into version specific syntax and can push it through SSH to many firewall implementations like ...


0

Technically, the list of treatments is a bit longer (event if we consider only RFCs) - there's ICMP type 3, code 2 (protocol unreachable). There's ICMP type 3, code 4 (unreachable, fragmentation needed) when doing MTU path discovery. There's ICMP redirect (a bit esoteric, eh?). Keep in mind that these days you'll be dealing with multi-layer firewalls/NGN ...


2

The difference is in the amount of information you provide to the sender of the packet. says, essentially: "No-one here. Your SYN packet went to nirvana." It provides the least amount of information to the other end. It also slows down attackers because they have to wait for a timeout. says: "Forbidden. There's someone here but they don't want to talk to ...


4

In regards to your first question: The protocols you use will matter when leaving the VPN and going to the servers that you are trying to contact, so anyone sniffing traffic to those servers will be able to see what's being sent. In regards to your second question: If another person using EC2/Digital Ocean were able to sniff your traffic through that ...


4

Is this the end of malware use of DNS? No. Might tweak the landscape a little, but not hugely. It seems like the dataset in the news article could protect against both. It's useful for catching people using malware that other people have caught before. It is not useful for catching someone who sets up a burner domain just for their attack ...


3

Revealing the internal IP address is not always down to the proxy, sometimes the back-end is not properly configured, and its web server would "leak" system details, such as application paths and configuration details. One area that is particularly "vulnerable" to data leakage are error pages - default IIS and Apache error pages may reveal the internal IP ...


16

These types of attack could be achieved via multiple CSRF attacks against the IP addresses discovered via the JavaScript reconnaissance tool. Say your local IP address is 192.168.1.100. You visit the malicious website, the JavaScript runs and finds the device 192.168.1.254 on your network. Now, depending on how complex the JavaScript is, it will either ...


6

Many routers have a web-based admin console, and it sounds like that's what this attack exploits. Frequently, the admin console is only accessible on the LAN, rather than allowing external connections - and this malicious JavaScript is what's used to bridge from the attacker's machine to the LAN. One potential way that this attack could play out: ...


1

Your interpretation is incorrect. WPA2-PSK doesn't completely encrypt layer 2 information. Management frames are unencrypted (except in cases where management frame protection is implemented). MAC addresses of all communicating parties can also be observed, which somewhat helps to analyze communication flows and gain general information on the network. The ...


-1

Suggested reading on protecting against ARP poisoning and similar attacks in a switched network: Dynamic ARP inspection and DHCP snooping: Network Security Technologies and Solutions - (CCIE Professional Development Series) - Ciscopress


1

Without knowing more about your company's network layout, business model, physical access restrictions, etc... it is hard to give more than general guidance. RDP has been known to have remote execution vulnerabilities. RDP can also facilitate password attacks. So you can't look at running RDP as risk-free. It is not unheard of for companies to restrict RDP ...


4

Here's how I would do that: Examine all the test descriptions from sites like badssl and Qualys SSL Server Test. Follow up on links to the actual issues being tested, read and understand the problems. Run Qualys against your server, capture the traffic using tcpdump, and examine the interactions as much as possible to understand what's going on. Set up ...


2

It is not a security risk if you are able to read your own WiFi key since whether you are running Windows or UNIX like operating systems, there are many ways, including through a GUI, to get it if you are connected to your hotspot at least once. If you are worried about security then you can log to your router and change the default password that comes ...


4

The network you've set up uses pre-shared secret authentication. If you're already on the network, then you know the password so seeing it in plain-text isn't that much of a big deal. In most enterprise environments, they use 802.1x authentication so there's not much to be worried about. Could I access the password of wireless networks as they are ...


0

you should change your hostname too btw this bash script can be useful (macchanger should be installed): echo "" echo "THIS SCRIPT WILL SET A RANDOM HOSTNAME AND" echo "RENEW YOUR I.P. WITH A RANDOM MAC ADDRESS" echo "" echo "" echo "TO ABORT PRESS: Ctrl+c" echo "" echo "PRESS ENTER TO CONTINUE: " read enter sleep 0.25 clear sleep 0.5 #Get Random String ...


5

You could sniff the network for traffic and change your network configuration to an active machine(i.e. MAC address): # ifconfig wlan0 down # ifconfig wlan0 hw ether DE:AD:66:55:12:34 <== sniffed MAC # ifconfig wlan0 up assuming wlan0 is your wireless network interface. On Windows you can do something like this. Now there should be two work stations ...


2

Do we have any Events code for Unix as we have in Windows. nope. what you have is a bunch of software that writes logfiles, but these logfiles do not follow any standard. If Not, On what basis can we write alerts for unix flavours or machines . for Auditing,application or network based alerts. network-based attacks are usually detected by a NIDS ...


0

I once wrote a script in Python to sniff DNS requests off the wifi network and log website names (host+domain names) users are visiting/resolving. Using the Python scapy library, its quite simple. The data was logged into mysql in order to be able to get various statistic afterwards. I dont't have the script available at the moment, but if you dont't find ...


0

My router can do this (verizon). Just go to the default gateway and look for tools. In my case it is disabled by default.


0

It depends on what hardware you have available. For example, if you have the possibility of plugging in the network e.g. a Linux server, you could set it up as a gateway. It's more complicated, but way more efficient and a whole lot cleaner: -- router ------ network server -- WiFi AP -- ( NETWORK: 192.168.3(*).2...254 ) 192.168.1.1 1.1 2.1 ...


0

Log dns queries and match them to client ip. Doesn't work if client changes dns server though. If one has a wifi network, they have a router as well. Router usually provides dhcp and dns services. Any decent wifi box has logging features that can be enabled to log traffic to some extent. Another way is to modify dhcp to provide another dns box which logs ...


2

The exact answer to this depends on the level of control you have over the wifi network. Assuming that you can dictate things like proxy servers, then the best option might be to install a forward proxy (something like squid) and then have that do the logging for you. If you need to know actual URLs rather than just sites, you'll need to set-up SSL ...


0

You have take each address, and calculate it's subnet ID (network address) using the subnet mask. If two hosts have the same subnet ID (network address), they can communicate between each other without the use of an router. You can do this using a subnet calculator like this one: http://www.subnet-calculator.com/subnet.php?net_class=A Or you can do it ...


0

Traffic based. An example of an traffic based attack would be sniffing. By implementing VLANs, you seggragate traffic into different VLANs so that traffic that belongs to one VLAN is only visible in that VLAN. If there were no VLANs, an ARP spoofing attack could affect the whole switched network. In case there are VLANs, it would affect only the VLAN on ...


1

This might be best explained by an example: patching of servers. In any decently sized network you're likely to have a myriad of servers. Some running applications, others serving as network infrastructure such as firewalls, routers and so on. All of these run a lot of software. This software is bound to have bugs from time to time. If you don't know which ...


5

If your network is undocumented, then you don't know what all the parts are, how they are set up, or how they interoperate. That in turn means you can't reliably do any of these crucial things: do a full risk assessment identify required controls implement those controls fully measure the controls to confirm they are working monitor the network so you can ...


1

Only in the early days of hacking did RATs require the lack of firewall in order for the controller to connect. Take the famous example of SubSeven -- the RAT would install, and join an IRC channel advertising a port and IP address. If the victim was behind a firewall, the machine could not be manipulated -- the hacker would just get a connection timeout. ...


4

The communication between computer goes both ways, so there can be two cases: The RAT is a server: this is the case for many well-known and legit remote access tools, like remote desktop, VNC etc... In this case, you need to allow port forwarding on your router to be able to access the computer. The RAT is a client: the tool will try to connect to a ...


0

That is not possible. The only way you can detect if someone setup a router with NAT function is to analyze the hardware addresses (MAC) of the endpoints. But the hardware address can be changed so that not very reliable solution. Another way to detect WiFi networks is by physically move around in the area of the network and scan for WiFi networks with your ...


0

Sort of. You can create a landing page that lists all client IP addresses using WebRTC and load another address. You can use gethostbyaddr() on every IP returned, and you will get some user198.domain-a.company.xxx. Just set a session variable, and you are set.


0

Not really. You can directly retrieve some agent information and the local IP/hostname but not their workgroup/domain status. That being said - you could get the hostname and query Active Directory via WMI to see if it is a domain computer, but you can never prove the validity of the hostname. Another option is that you can authenticate a user against ...


-1

It's possible to get corresponding to a given IP address using gethostbyaddr function http://php.net/manual/en/function.gethostbyaddr.php: $proxy = (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : false; if(!!$proxy){ $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR']; echo "Warning: Your cliend is using proxy, may could ...


0

Just creating an extra answer here to make it more visible for people to find... After reading around the subject, the only 'security' to protect yourself from these stingrays seems to be the below app that is only available on Android so far: SnoopSnitch It doesn't stop your phone connecting to these stingrays, however it can apparently detect when ...


2

It's not recommended, but it's possible. Look for an option labeled TR-069 in your router, then disable it. Simple as that. TR-069 basically enables your ISP to change every* setting in your router, and disabling it disables ISP control over your router. But do take note that if your ISP has some configuration changes (very unlikely), It won't get to your ...


1

Note that I am not an expert in this field, this information is gleaned from other sources. 3G Interception tools are about to appear (or may well have already done so). The "Stingray" from Harris is the most commonly quoted product and is widely used by US "law enforcement" (or maybe that should be law ignorement!) The tech blog Techdirt is a blog I ...


1

Unfortunately not the way you are thinking. But things are never simple on information security. Most of phones that I'm aware of, does not let you select a specific tower you want to connect. This is a usual GUI for Android: and the relevant ones on Engineering mode GUI: Why you want WCDMA only There are others too, but I won't add here since it's ...


8

Blocking ISP access to their own device is not a clever idea. Instead just buy another router and connect between ISP's router and your computers. Then move all configuration related to your LAN to your router and configure ISP's router as bridge (or put your own router in DMZ). This way ISP will have access only to the bridge, and not to your LAN.


2

You are certainly adding risk though whether that is enough to worry about may be difficult to calculate. Is it against the terms and conditions of use of the ISP? You both could get cut off. Low to medium risk, relatively low impact. Will someone in their household do something illegal that you might end up on the hook for - because you cannot prove you ...


1

I think it comes down to how much you trust this person. Public Wifi can be dangerous because attackers can use things like packet sniffers to detect traffic and obtain passwords and other identifying information over the same network they're in. This guy could theoretically do the same without you knowing it. Depending on the network settings you have on ...


-1

I mean your answer here really determines on the model/device they gave you. Assuming typical name brand router/gateway device... why not just do this: 1) get the ISP or service repair tech they send out to change the password for you to something you both know. 2) Then, after they leave log into the router/gateway device. 3) And change the password to ...


4

You've basically answered your own question. The way I see it is that an attacker can disconnect everyone, including the attacker, by performing a denial of service attack or exploit a vulnerability in the IRC daemon/server. While performing a denial of service, in theory the attacker could gain op in one or more channels by stopping the denial of service ...



Top 50 recent answers are included