Tag Info

New answers tagged

0

In concept it is a worthy proposal, but it takes some thought and effort to become effective. If the IT Staff demands this the company must also pay for it, otherwise the user will get the cheapest line and modem/router available and cheap often means insecure in some way. It is inviting a weakest-link situation. Just a separate connection without ...


1

Having the client connect is the standard way of dealing with NATted connections. It can also known as a 'Reverse Shell'. BTW, I know you probably want to write your own RAT, but Metasploit might be a very effective demonstration ....


1

It looks like UDP port 1374 is being used in a UDP reflection attack. This type of attack is possible by simply exposing a UDP service to the open internet. Some UDP services like NTP and DNS, are quite valuable for their role in UDP-amplification DDoS. Exposing unnecessary windows services to the open internet is extremely reckless. I hear an old ...


1

It depends on who "they" are. If you're torrenting, the university can use commercial traffic inspection tools to identify p2p protocols. The tools are signature based, and the signatures are proprietary, so the exact methods used and methods to circumvent them vary. If you're torrenting illegally distributed copyrighted content, then the rights holders ...


0

There is legitimate security value in this configuration, if implemented properly. Whether that value exceeds the cost and complexity would have to be determined on a case by case basis. The security value is this: If work devices (work PC, phone) are on a physically separate network, the devices themselves cannot be attacked by other devices in the ...


0

You can use the open-source Linphone to place secure calls. It supports: HD Audio and video call Secure communications (TLS, SRTP, zRTP) You would need to use a free SIP service that supports authenticating and transporting traffic through TLS (not all do), like Linphone SIP service or Ostel. For detailed instructions on how to set up secure ...


1

Just to clarify, when you say modem - do you mean just that? Or do you mean router or modem/router? Without a deeper understanding of the infrastructure on the employers end, I honestly don't see how having a separate modem will increase security. It's more important that split tunneling is disabled on the VPN client. Most modern home class routers allow ...


0

Beside what you have already done disabling WPS and using whitelisting: Use the latest firmware Disable TKIP, just use AES. Obviously... change default login / wifi credentials. Use a decent password. Disable UPnP. Firewall policies to DROP, only allowing what you are going to use (80,443,22,53,3389...). Limit the amount of DHCP devices, also set them to ...


3

I think there are many factors that could make it a legitimate request: other people in the home who might need network segregation load balancing old equipment (getting a newer modem) VPN configurations I, myself, have made the same request to a certain remote employee to ensure separation of use within that employee's home. Sometimes it's simply to ...


0

Another problem is, that most modern websites requests resources from other hosts (JS libraries from a CND or even from a server controlled by the website owner) and the URI contains the DNS name in the most cases. You would have to know the IP addresses and proper HOST header of all the resources the desired website needs and stop your browser to resolve ...


23

As others have already answered: Yes, Skype originally did sometimes use other Skype users to route some calls. BUT!!! What the other replies didn't say was: This was actually A GOOD THING! Because Skype was initially Peer-2-Peer based not server based (as Microsoft made it) and all traffic was encrypted from end-to-end it gave Skype two big advantages ...


4

As for the other part of the question: why are users sticking with it while there are better solutions? Two words: market penetration. Average John Doe doesn't care about security or abusing (in the olden days) other network users. He just wants to make calls, this just works and he's not going to persuade all his friends to use something else when ...


32

Today, Skype do not route communication through other users machines. This is done by Microsoft servers in datacenters. But back in the days, in the early versions of the Skype protocol, every user with strong-enough bandwidth and not behind a NAT (with routable IP address), can become a supernode and route the traffic of other users that are behind NAT. ...


0

Victim computer has private IP 192.168.1.147 and public IP 10.1.1.44 and attacker has private IP 192.168.0.119 and public IP 10.2.1.54, how do the two computers communicate with each other? Assuming that victim computer has a listener on port 1234 and attacker has connector that connects to port 1234 and takes IP of victim. What IP would the ...


0

A trojan opening a server port is one, but not the only way to allow a remote attacker access. Another method is to have the trojan initiate the connection itself. When active, the trojan will open a connection to a command-and-control server under the control of the attacker, submit information to identify itself and the machine it is running on, and ask ...


7

The attacker doesn't connect to the victim computer, the victim computer connects to the attacker. Data in a connection can flow in both directions, it doesn't matter who initiates the connection in the first place. Once a connection is established the attacker is able to execute commands on the victim computer. The attackers use well-known web protocols ...


0

You can use Entropy Estimation for the stream data. Let's say the payload is encoded in ASCII or ANSI and for printable characters values from 32 to 127 are used . Based on the entropy of the encoded symbols of the stream, you can develop an algorithm that identiļ¬es any text blocks within the payload (in case of unencrypted data) or not. In this case,the ...


2

Do some sort of packet capture. Depending on your level of concern and technical ability you have two relatively easy methods available. If you have tcpdump installed just run tcpdump -A -c 200 if the output is clear text then this is a clear answer. If it is not then possibly your traffic is encrypted. (note: it could just be encoded and not encrypted, ...


-1

In my opinion, some products in the market are too similar. I know some firewalls and intrusion prevention system support this for control purpose. Second, I once heard that Aobo Filter for PC http://goo.gl/xuLdXm can be used to block websites, especially record websites visits in private browsing mode. Then you just need to add URLs to blacklist. I have ...


0

They're saying, "Don't hook up a server with cardholder data stored on it directly to an ADSL modem". In other words, firewalling has to be employed between the Internet connection and the cardholder data environment (and must be employed following the PCI spec).


2

The connections CrashPlan uses are encrypted using TLS. (I've casually seen the traffic when looking at other things.) As for whether or not it's safe: the protocol doesn't really matter, only whether CrashPlan has exploitable bugs in their software, and that's pretty hard to discern without either extensive reverse engineering or access to their source ...


1

There is no good software way to do this. Monitoring outgoing traffic on computer with the camera is no good solution as your traffic stats may be faked. If someone gains such a good access to your webcam to disable the light, faking traffic stats is not a huge step away. You could measure the traffic on your router, but then you would need to read the ...


0

Perhaps the best and only way to determine if your webcam is transmitting images without your knowledge would be to use a network monitoring tool to actually inspect the traffic packets themselves. Just because your outgoing traffic is 1kB/s doesnt mean images are not still being sent -just slowly or broken up. You best bet would be to install something ...


0

Check out the name of the device through Device Manager in windows. When you have the name you can look it up with Process Explorer. Is any process running your device?


3

Many copy machines and all-in-one scan/print/copy/fax machines (especially from HP) have internal hard drives they use for temporary storage. It's been in the news from time to time that people have recovered sensitive data from these drives, either using data-recovery software or by simply reading the drive filesystem.


0

You may also want to check out IronGeek's ARPFreeze tool: http://www.irongeek.com/i.php?page=security/arpfreeze-static-arp-poisoning


3

Is it common for scanners to somehow cache or log documents they scan (on the scanner machine itself)? Yes, probably nearly all which aren't specially designed to be hightly confidential Does scanner driver/software often have temporary folders which end up leaving a trace of the document? Yes also. Can a networked scanner maliciously or ...


3

You are somehow thinking that dead tree docs are less secure than digital copies. I may venture to say you are mistaken in this belief. Digital data may be stolen in a myriad different ways. The scanner may be reporting to HP or other companies/agencies, while your computer may be already compromised. Your computer will have vestigial data on the hard ...


3

According to my research on the subject, and running tests there are no quick fixes for tracking the source individual perpetrating this type of attack because of the nature of it. Meaning tracking, but not filtering/blocking. The attack method itself is basically easy to do compared to the scale of other types of attacks out there due to fundamental flaws ...


0

The general rule of thumb is that if you think that you've been compromised then your trust in the system is no longer there and as a result the action you're taking is what you should consider. With a wireless network it is difficult to tell who is listening in, but that is more likely than someone intercepting your traffic and modifying it. I'd be more ...


4

A switch will try to only send traffic to its intended recipient. But it is not guaranteed. If the switch doesn't know where the recipient is, it will send the packet to all devices connected to the switch. There are ways to make a switch forget where the intended recipient is (such as overflowing the CAM or MAC spoofing). There are also ways to make ...


1

If you are concerned that your ISP provided router may be compromised, you should replace your router with one that is under your full control. Unfortunately, with the pitiful state of home router "security" in general, this may not be that much better. It is true that switches are designed to forward ethernet frames only out of the ports connected to the ...


1

That depends on whether you're talking about local or internet traffic. For internet traffic, it doesn't matter what modem you use; your ISP can see EVERYTHING that you send out onto the internet. After all, they're your bridge to the internet, and everything you do passes through them first. It doesn't matter who the traffic is "addressed" to; it's ...


1

1. Protect the server from getting hacked For this you could find multiple hardening guides, which combines locking down your machine, keeping it up to date with hotfixes and so on. 2. the data stored on the server should be encrypted Ensure your data is encrypted, you could do this using symmetric encryption (you suggested AES, with the key being a ...


3

The first step in securing anything should be to evaluate what you need to secure and where somebody might attack you (attack surface). I don't know what you have to protect, but since you are doing your computing in the cloud you should not only ask yourself how to communicate with your cloud application, but how the application itself is secured, that is ...


2

The difference is exactly the same as the language suggest. "Shared key" means that the same key is used by several party. It doesn't tell you how the key was distributed among them. "pre-shared key" means the key has been shared before the current operational context. To go you two examples: When you perform a Diffie-Hellman key exchange in an SSL ...


2

It's sort of like asking the difference between a car and steering. When you are driving a car, you can (and probably should!) steer it. But you can steer a bike too... Enough with the analogy, the difference, in my view, is that MitM is a class of attack and the sniffing is simply the word for analyzing packets on the network (and often just the packets ...


2

A sniffing attack is a attack on confidentiality. It can be via a span port on a switch, processes on servers through which the traffic passes, on the end user client. Sniffing is often an MITM attack but it is passive. A MITM attack is typically a more active attack where the traffic route has been altered to include the adversary, such as a rogue access ...


6

Typically, an eavesdropper (sniffer) will be passive -- that is they will not modify the traffic. Man-in-the-middle (MiTM) attacks usually imply an active adversary -- one who will change the contents of the message before passing it on. The two are not entirely distinct, as a MiTM may use their active attack to read the contents of messages, or simply to ...


1

In the Information Security world, internal attacks or inside malicious attacks are known as Insiders. Someone who can poke, sniff and even can do anything with a trusted identity is an Insider and can install malwares and anything bad.


1

For me, insider attacks and internal attacks perfectly fit your description. If you want to find a more specific name maybe try to be more specific on what kind of malicious activities the node is carrying out in the network. The paper [1] is from the field of wireless sensor network (WSN) security. A WSN is a distributed system of sensor nodes. There are ...


3

I would say a malicious internal actor. Internal actor meaning that he is validly participating in the network, but malicious indicating he's abusing the system.


1

Normally we call that kind of attack "spoofing". It usually implies that there's some kind of active interaction involved, whereas sniffing is passive.


0

I agree with everything that the first person to answer your question has said -- this is likely a router DNS hack, UNLESS there is persistent malware on some other endpoint (say, your child's computer) within your local LAN (the one whose IP addresses start with "192.168" etc. etc.) that is attacking the rest of your local infrastructure faster than you can ...


1

What you've described sounds like your router's DNS settings have been changed to use servers under the control of your attackers. You can confirm this by disabling the proxy server. If you disable the proxy and the problem goes away then wipe the proxy machine and start again - it's the only way to be sure. You can reset the DNS server settings to what ...


0

I think it is worth noting that even if the network was password protected it would not help much as the thousands of others would be on the same network. Most important is how the network people setup the segmentation of the wireless. "Don't allow wireless clients on same AP to see each other" for example. Really the bottom line is to make certain the ...


4

If you are on unsecured WiFi, all of your internet traffic is broadcasted for everybody nearby to see. This means that any traffic to/from your computer that is not encrypted at another layer (such as SSL/TLS or SSH) will be visible, which can expose sensitive data, such as usernames and passwords, or authentication cookies. In addition to passive ...


3

Users of applications cannot. They can only try to not have rogue apps running on their systems. In this case we have an app that is normally harmless or even (attempts to be) beneficial unless it detects you're approaching a juicy login. Some, each alone insufficient, ways of "protecting": do not install untrusted apps or from untrusted sources. pay ...



Top 50 recent answers are included