Tag Info

New answers tagged

2

First, a comment; sometimes (read "almost always") I get a cool new toy, app, technology and I try to fit it in in every possible place. Even in places that don't work, I enjoy figuring out why. It's a learning experience. The term "Threat Model" may sound either overly theoretical, or dismissive of your case. The purpose is for the security consultant ...


1

Having once worked at an edu, it was our goal to make things as seamless and painless for the clients (students) of the University. As a professional, there were many things that we championed for especially when it came to security. For example, we opposed P2P network, because traffic patterns at the time pointed to students downloading music (back then ...


0

As the traffic leaves the university it sets on a long long journey across the globe until it reaches the server it was meant for. During that it passes lots of countries and uses lots of people's datacenters. They all can spy on you. You need strong end-to-end (TLS) protection to be safe from those people. With encrypted WiFi you can protect from others ...


4

I think you are worrying about the wrong thing. You should have no reason to trust the local network any more than you would for any data you'd send over the public internet. If you want to send a password, it's your responsibility to ensure you're using a connection protected by TLS. Trusting the local WiFi to protect your data is essentially excluding ...


1

If I understand correctly, your computer serves as a Wifi Access Point, so it should have a dhcp server running on wlan0, is that so ? Assuming this is the case, First you need to have /proc/sys/net/ipv4/ip_forward set to 1 instead of 0 (if you are using IPv4, I don't know the equivalent for IPv6, if there is any) The iptables command you are looking for ...


11

"Can't be blocked" is impossible. Even if you don't know the location of the source (say, they're using a censorship-resistant system such as a Tor hidden service), you can still perform a denial-of-service attack, though doing so would have substantial collateral damage (a successful DoS on a Tor hidden service will likely render the entire Tor network ...


0

If your internal production AD is critical and contains sensitive systems, DATA etc, which would have a high business impact if compromised then you should consider a seperate forest. If a completely isolated "DMZ" forest is not practical or too costly to manage (high admin costs through account duplication and so on) you can consider a new "DMZ" forest ...


16

As far as I can tell, you’d need to define where it would be “Live Streaming” from. For example, if someone used darknet (Onion/TOR) to stream, it would be very difficult since there are a lot of randomized layers. No one would be able to block a live stream since it would come from various sources (nodes). There could be no mechanism to have ISPs block ...


6

For police, requests like this are made to the ISP (which would be easy to ascertain), or the streaming or hosting service (also easy). The problem is the timeframe. It would take time to coordinate with the ISP or service. It is going to be 'impossible' to turn off a website within an hour, for instance.


0

Malware/rootkit and other malicious techniques are reported to use the old-but-reliable“sticky keys” technique, whereby “sethc.exe” is overwritten with a copy of “cmd.exe” to provide unauthenticated access during RDP logon,http://windowspwnage007.blogspot.in/ ,one example is Hikit ...


2

Note that magic packets work regardless of their type. Your tool requires root because it sends Ethernet frames directly. However, there is nothing stopping someone from sending the same data inside UDPv4 broadcasts, which is in fact done by practically all other wake-on-LAN tools. (UDP port 9 is common.) This makes network security concerns mentioned in ...


12

That utility needs root access because it uses a raw ethernet socket. In a similar way, ping needs root access, as it also uses raw sockets. The difference is that (on most systems) ping is suid-root so any user can run it. If you're happy with non-root users generating these packets, you can make etherwake suid-root, or use sudo as you suggested. There is ...


3

The act of powering down or powering up a machine should be restricted to a small subset of administrators and security personnel in your organization. The act of remotely sending a Wake on Lan packet could have serious negative security and administrative implications if it is given to the wrong users. If you are worried about adding a user to the sudoers ...


2

Any self-verification mechanism included in the executable file could be replaced or removed by the attacker who intercepts the file. Therefore, we must leave signature verification to a system external to the downloaded executable, for example, the operating system. There are three possible outcomes such a verification system can produce: The signature ...


1

Sounds to me like you looking more at the integrity of the actual file or data. When it comes to checking to ensure it is not infested with a possible virus, that where your Antivirus comes into play, or a UTM on your Firewall. For instance; a Sonicwall Firewall appliance would be able to ensure the safety of that file. but the actual integrity of the file ...


0

Download same version from top-10 results for "putty homepage" returned by your favorite search engine, and compare them. If they are not all completely the same, abort the installation. Otherwise, install it (from any of downloaded bitwise-identical copies, of course). If you need more security, interpolate results from different search engines and ...


2

Because virtualization software is not perfect, it is in some cases possible to escape out of the virtual environment and do bad things on the host. It is important to keep your virtualization (and other software) up to date, because security patches to prevent this attack are sometimes released. I believe that malware could indeed then be put onto the ...


0

Short answer: no. The hosting network can't be affected from within a virtual network. A bit longer answer: by design, a virtual network should be considered a sandboxed virtual environment within a physical implementation of a networking environment. You can't break out of the sandbox. So the hosting network can't be infected by the virtual network. ...


0

If the university requires you to download software, there could be vulnerabilities or even a slight chance of a trojan horse in that software that could have bad privacy implications. Hopefully the software has been thoroughly reviewed though. This is a risk you take with pretty much any system / software though. If you are concerned about misuse of the ...


0

It depends of if webcam recording is triggered by you or the University. I guess the computer is owned by you, and its simply that you have to install a mandatory webcam software to do the course. If you then have to push a button "Start streaming", then its no danger at all. It does not matter if anything is transmitted unsecurely or unencrypted. It does ...


0

So I am not exactly I sure I understand the question because you mention this video feed is over unknown applications. So this is what I think is happening and sorry if I get it wrong. The University wants you to video yourself taking tests and working one certain material. This feed should be sent out through a known application, although it may not be ...


3

No, you won't be able to do a MITM attack on the edge router and your access point/router. In order to perform a man in the middle attack you must be on a network segment that allows your device to actually get in between these two routers. As programings already pointed out your gateway is the internal router/access point, which means that without it you ...


0

There are a few critical details missing. What OS were you using? Many platforms provide or require code signing, but you don't tell us what platform you're using. OSX will by default only run signed binaries. Windows displays the CN of the signing certificate if present (or something like that--I can't remember the precise behavior). iOS will only ...


-1

Oh you all mess up with this simple solution. Let me teach you: First of all, you have to remember that the Internet connection can only take place through the IP address. Besides, even though both computers have the same MAC address it doesn't matter, so all you have to do is to manually change the IP address of one of the computer and it will really solve ...


0

If your connection to the source was through https, you most likely didn't have the data being transferred tampered with. You would have to be the target of a fairly talented hacker that's been waiting for you specifically. This assumes that the certificate you accepted on the unsecured wifi was valid however. Since you were on an unsecured wifi, you could ...


0

I know that this may not be what you are looking for since you mention DNS, but IMHO, same-site scripting (SSS), by interpolation from the definition of XSS (cross-site scripting), is a class of attack whereby a malicious user injects javascript code on the HTML page of a website targeting the same domain. Any website that is vulnerable to XSS will also be ...


1

Based on the link from Julian's answer, it's pretty straightforward. It does seem a little dangerous but nothing critical. how the web works Imagine you have a website. Browsers send HTTP traffic to that website. This traffic includes session cookies. The site should be TLS protected, or your session cookies are going over the internet in cleartext, for ...


1

Although I can't pretend to understand all the details of this, it does appear that this is dangerous. See the original post here. While superficially this may appear to be harmless, it does in fact allow an attacker to cheat the RFC2109 (HTTP State Management Mechanism) same origin restrictions, and therefore hijack state management data. The ...


0

You could possibly achieve what you want with what you have.. If you change your computers LAN MAC: Windows: http://superuser.com/a/350589 Linux: http://unix.stackexchange.com/a/139870/83643 Have your router setup, as you have it, using your PCs MAC address on the WAN Port. And additionally configure port forwarding on the router (if the router is ...


5

For many Linux browsers (I've tested Opera, Firefox, and Konqueror), this is normal: a bare / is an invalid URL (there's no protocol), and it gets interpreted as file:///: "display a directory listing of the root directory". There's no security risk here: only you can display the contents of your computer's root directory using a file: URL, you cannot ...


-4

This may sound crazy, but you could just talk to the guy. He's your roommate, so I'm sure you already have some ground rules established; and if confronting him outright is a problem go to him with your concerns that someone has compromised your computer security. If you talk about how freaked out you are about it, I'm sure he'll stop- or won't be able to ...


1

Since access has been sufficiently restricted, the weakest link is the HTTP request. This is especially true based on comments regarding the poor interfaces of the IP cameras. They likely won't do well if irregular requests are sent. Therefore consider a Web Application Firewall (WAF) such as ModSecurity as it will provide more flexibility over what ...


9

Hacking a television station is hard. Most of the broadcast infrastructure isn't connected to the Internet, making outside intrusion difficult or impossible. Let's say you want to hack your local news station. Problem #1 is that their equipment isn't connected to the Internet -- it's quite possible that they're still using a bank of Betamax machines for ...


2

The communication link between the application and the DB is the issue. If the application is what you consider your CDE then the database will be in scope because it is connected to the application. Depending on your access controls and other security controls for segmentation you might be able to remove the management portal from scope (assuming it sits on ...


3

We can understand your concerns. We do have the ability to ssh in to your router, yes, but access is limited to 4 people, and it is only done for trouble shooting purposes. The goal of BISmark is to enhance our understanding of broadband networks. We do not collect any personal (PII) information. We are simply not interested in it. We are interested in how ...


0

IANAQSA No, I don't believe you can achieve the separation you're looking for. The PCI v3 quote you've provided describes using adequate network segmentation to isolate systems. What you're really asking, though, is can you isolate Shared DB (card details) from Shared DB (configuration)? And the answer is no, you can't, because they're... ah... Shared. ...


1

I partipicate itself in a similiar internet test. Here, the device in question are put between the WAN port of your own router, and the internet, thus the measurement device would be "outside" your firewall and a owned measurement device would not give the hacker more abilities than direct access. I cannot tell if BISmark does advise the users to put the ...



Top 50 recent answers are included