New answers tagged

-1

best way to do so is to utilize remote syslog ability : even failed attempts are usually logged there. Linux/Unix syslog server setup is as usual as just accepting logs from your router IP, and - of course - a static IP is required for this to work without problems.


0

You could check the DHCP server in-particularly the leases. You may find MAC's and Hostnames.


1

Does this represent a security issue as I thought the two networks are separate and so should not be able to ping each other? Whether or not it is a security issue is up to you, but the router is behaving normally. Because the router is directly connected to both networks, it understands how to send traffic between them. To avoid this, you can ...


0

First, quit using FTP entirely. The most common choice is to use SFTP instead Disable weak cipher suites like ones using RC4. There are other hardening steps you can take as well. The next common choice is to use FTPS instead. Disable weak cipher suites like ones using RC4. There are other hardening steps you can take as well. If you would like, you ...


1

Both will do what you need effectively. Whether you need to use one over the other depends on your use case. From what you have described, as long as there aren't other requirements, I'd go with TLS, as it requires very little additional work on most network architectures. IPSec is just a little more convoluted to set up - but it does provide additional ...


1

Agree with what Drewbenn commented. It appears that your account was opened in a significantly different geographical location. Netflix recently made changes to what type of traffic they will permit to stream. Without knowing more about where you opened your account and where you now reside it's difficult to pin that down as the problem. See below: ...


0

Yes, this is possible, even with arp_filter set to 0. Server listening: # nc -nlvu -s 192.168.250.1 -p 123 listening on [192.168.250.1] 123 ... Connection from Client 1 - Client 1 is set to route all traffic via server, so it does not need any ARP response for eth1: # ncat -nvu 192.168.250.1 123 Ncat: Version 7.01 ( https://nmap.org/ncat ) Ncat: ...


-4

How paranoid are you and how much money do you have to spend? If you have money to spend then I would go to a local big box store and buy a cheap laptop off the shelf. Take it to a local library, unbox it there, wipe it clean, download a decent Linux security distro livecd and install it on the laptop. SecurityOnion isn't bad. One thing to look for is ...


1

You should check whether your current IP is on a proxy list. Since your IP address is assigned dynamically, it could be that the former owner got himself onto a proxy list - these lists get generically blocked by many pages. It is, however, easier, just to get a new IP and try again.


1

It's possible there's some confusion here regarding your question. What do you mean by payload injection? Do you mean something that exploits a vulnerability and uses that to inject code? I'll start with the assumption that you mean injecting code. Payload Injection and you It's possible many people here are misunderstanding the term "payload." ...


3

It's called a remote code execution vulnerability and Windows had several of these in the past which were exploited quite widely. A good example is the Win32.Blaster worm from 2003 which propagated automatically by exploiting a weakness in Windows DCOM RPC Interface. When the worm was released there already was a patch for the vulnerability available, but ...


2

It's entirely possible to hack a system without malware, you can do this by taking advantage of vulnerabilities in applications/OSs or poor configurations. Some great examples (some historic) are: Default passwords: there are still routers on the internet with the default password cisco (or no password at all), or servers with system/system, root/toor, ...


4

Sure. Set up a SSH server with a weak root password, and leave it on the internet - within a few hours, you'll have been hacked. They will probably then upload a payload of some sort, but could just as easily pull the data from the machine with the existing software stack. Essentially, the key would be exploiting some form of authentication flaw, or dealing ...


1

The privacy of a system is all about making clear to the user how their information is going to be used and shared. That is, the amount of control an individual should be able to have and expect. The security of a system is ensuring that this expectation of privacy is met. That is, the mechanisms that can be put into place to provide this level of control.


0

I'm assuming that the client connects to your web server by way of HTTPS (if the client connects to the web server by HTTP, then eavesdropping or an MITM attack is trivial if you control the network that your web server is on). Assuming that it's an HTTPS connection, then if you have the private key that corresponds to the public key in the web server's SSL ...


5

Security is defined as the state of a system in which confidentiality, integrity and availability of data is granted. Privacy is the ability of a natural person to control the distribution of his or her personal information. If you are using for example a system of a big company - let's call it Oogle - it might be that their system is pretty secure, but ...


2

I agree with AdHominem that TCP/IP is a complex set of protocols. Based upon your self-ascribed "experience from curiosity", I think you would do great with a book titled Guide to TCP/IP from Cengage Learning. This is the current edition Amazon.com: "Guide to TCP/IP" Fourth Edition I have the third edition Amazon.com: "Guide to TCP/IP" Third Edition. I ...


1

TCP/IP is a complex topic and there are probably many answers to your question. For a beginner, after reading the respective Wikipedia articles (often an underrated source), I can recommend the CCNA Study Guide, they are not only taking Cisco hardware into account and it's a renowned institution. The CompTIA Network+ Deluxe Study Guide is much more in depth, ...


1

To elaborate more on Milen's answer, if you have no routing issues, then Transport mode is certainly feasible whether it's 2 gateways talking to each-other, or even 2 hosts talking to each-other (not doing IPsec). For example, if you had 2 public DMZ servers talking via Telnet over the Internet to each-other, and deeper in the network 2 IPsec routers were ...


0

mitmproxy (http://mitmproxy.org) is a free tool for man-in-the-middling HTTP traffic and can accomplish this in a few ways. The most straightforward and easy to demonstrate would be to use the web interface (mitmweb) which would allow you to click on individual image requests and see the image in your browser. Since you're using your host as a router, ...


2

Assuming that you control both the app and the server, the best strategy for preventing MiTM in mobile apps is to always require SSL and use certificate pinning. Certificate pinning forces your application to only accept a specific cert. This will prevent an MiTM even against an attacker who has obtained an illicit but valid cert for your site.


0

I think you got something fundamelntally wrong. A MitM attack is an attack whichs goal it is to redirect traffic over the attackers host. The attacker then acts as a proxy but he will not be able to install an additional certificate on your host without having root/administrative access to that host. How to perform a MitM attack MitM Attacks are mostly ...


2

One way that an attacker can pull-off a MITM attack in a place where public wifi is available (like a hotel) it to create a fake wifi hotspot, which uplinks to the hotel's wifi. Then, the attacker can use a tool like sslsniff to intercept SSL connections. Edit: To protect against a MITM attack, the client should check that the server's certificate (or the ...


0

Depends what you want to do really, if you want to just want to be anonymous then use Tails. If you want to hack, Tails wouldn't be a good distro. So you need to set up your proxychains to go through TOR. See here: http://null-byte.wonderhowto.com/how-to/hack-like-pro-evade-detection-using-proxychains-0154619/


1

You need to supply the proxy switch when using curl: $ curl --proxy [PROTOCOL://]HOST[:PORT] For system wide proxy usage: System preferences -> Network -> Proxies Please be aware that using Tor as a system wide proxy will most likely identify you as a person and is not a good idea if you want to be anonymous. When for example you start your ...


1

This is impossible without knowing the password (WPA prevents this). However, you can set up an open fake accesspoint and use a captive portal to get the password in clear text. This would require you to social engineer the target into connecting to your accesspoint. You can for example keep sending deauth requests to the real AP and let the captive portal ...


0

From the client definitely yes, an attacker can sniff packets. This is not dependent or related to the MAC address at all. The OSI model bi-furcates the physical access and makes it openly accessible, which means that this is possible. Said so, there are ways as well to bypass filtering for MAC addresses on different access points making it a little ...


0

Defense in Depth/Layered Security is more likely a Core Security Goal for a company, it's a concept or should I say a practice of implementing several layers of protection. You can't simply take or risk a single action by just implementing a firewall or an anti-malware software, and consider yourself protected. You must implement security at several ...


1

The key difference is defense in depth (DiD) is a high-level concept. From the Wikipedia article: Defense in Depth (also known as Castle Approach) is an information assurance (IA) concept So it is much broader than a network security policy. The policy focuses on one aspect of security, the network. The policy also is a set of concrete requirements ...


1

Using either the Windows (host) firewall or the guest OS firewall to do that is not recommended. All VM tools already provide that kind of control. Have a look at the different types of networking available. You want a host-only network. By design that can only be used between the host and the VM, it is never accessible outside the host. I should also have ...


0

Either this or that. If a router is compromised, it can send a copy of the traffic to whoever's controlling it. If neither router is compromised, but an attacker has physical access to the line connecting them, he may be able to sniff. Copper wires are relatiely easy to sniff - a simple instrument placed near the wire can sniff the signal. Optic fibers are ...


0

Depending. If a DDoS of the size of just 1 byte over a half of the internet is launched on the rest, the entire Internet will be down. But that is almost impossible. Normal DDoS attack can be absorbed but not stopped. In the example above by Tom Leek, the security guy can handle only so much people, if the entire world come flooding in, they can do ...


1

You need to hide your GPS info. My browser asked me permission to use GPS location services in my Macbook Pro when I was entering the whatismyipaddress URL that you are visiting, and I denied it. So the site is asking for that. So it believes I am in California, USA. Otherwise with GPS, the scripts/site would find out my true location. It could be also ...


1

There is no legitimate way for an unauthorized eavesdropper to access those specific packets. So let's break it down: Make it legitimate. Eve* could ask Alice or Bob for those packets. Authorize it. Eve could be a law enforcement officer, and request the network provider to deliver copies of those packets. Be less specific. If Eve is a thief who just ...


0

Here are two ideas which show the dangers of phishing and social engineering, among other things. If it's a 10BASET or 100BASETX network (unlikely), Bob can fly to LA and try to find their network entry point. If Bob has enough money, this is even easier. Bob shows up pretending to work for the ISP and says he has to fix something. Corporate/business ...


3

I believe that you are asking if a side-channel can be used to extract information from encrypted communications without breaking the encryption. Specifically, can detecting the number of ongoing communication channels provide you with information? The answer is absolutely. Note that I don't know how UK police radios work or whether what you propose is ...


3

So in overall,which one should I prefer ? You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives. Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes ...


0

A keylogger like Micro keylogger can easily steal your passwords. Just change your passwords and never login your private account in those public computers.


4

First of all, I would change my password. Secondly, if at all possible, turn on two-factor authentication of some kind, so that you will be able to reset your password if someone should get access again, and actually change your password (is this possible with Hotmail? I know GMail supports it). You definitely don't want to be locked out of your own ...


1

Change your passwords from a trusted machine to prevent further access. Check your local privacy laws if that amount of monitoring is even legal in your jurisdiction. File a complaint that the monitoring activity interferes with your work and that you have reason to suspect abuse. But do not accuse a specific person without any proof.


7

TL;DR: Change your passwords Enable two-factor authentication to prevent attackers from changing your password Warn your sysadmin You should change your passwords ASAP. From a machine that you trust. What good is it going to do that the attacker can still log in too? What if they find a way to change the password, too? Any suspicious activity should ...


1

It might not be an admin, networksec, or a teacher. What if someone hacked their login? It might be best to raise the issue with your school. Do they have anyone that manages the security of their systems? Perhaps ask for a meeting with them and your college principal to have the issue investigated.


4

If you don't plan on ever playing Solitaire on your machine, why allow it through the firewall? You can always reverse your decision later if you decide to become a Solitaire fanatic, but until then it's safer to just deny Solitaire access. I know it looks legit and it almost certainly is the application trying to connect with the Microsoft network to ...


1

1) Set a strong password. Yeah, this may seem common knowledge, but I actually stick with something unique, alphanumeric, and not the default router password. 2) Hope that whoever wants into your network doesn't have something like Aircrack-ng. Aircrack is a network software suite consisting of a detector, packet sniffer, WPA/WPA-2-PSK and WEP cracker ...


5

Stateful firewalls are mindful of incoming connections that are part of a circuit that was previously established. iptables can certainly do this. The short answer is that you need a firewall rule that blocks all new incoming connections, but allows established incoming connections.


3

When you connect to your company's "remote access site", your computer is launching a Virtual Private Network (VPN) connection. This first installs a virtual network adapter called a 'tunnel' which is then configured to securely connect to your company's VPN server; at the company server, the other end of the tunnel emits your packets onto the corporate ...


2

What you are referring to is a split tunneling. Split tunneling allows you to directly access the internet from your device, while the device has the VPN connected to the remote location. There are a number of pro's and con's to split tunneling - in terms of security and other logistics. See ...


4

One of the primary concerns to limiting Internet access revolves around downloadable threats. Malware that may be part of a botnet. Viruses Rootkits etc.. These threats can obviously compromise security and is a common methodology used by attackers to gain entry to an environment. If you get an agent based executable installed to your workstation that ...


4

The answer is: No it's not a good idea. There are several reasons for that. The first and most important is that the mac address of the router is broadcastet by the router multipile times every second. This is done by sending so called "beacon packets" which contain a log of information which is realted to that access point. This means the mac address can ...


1

In my experience this sysctl -w net.ipv4.conf.all.send_redirects=0 will not work properly on some systems what works for me is echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects



Top 50 recent answers are included