Tag Info

New answers tagged

1

You could try doing this. Write a cron job that inserts a log entry at a certain start of the window. Monitor the file through some kind of file watching script. And at that point you correlate that with the http logs. The logs are in the common log format. http://ubuntuforums.org/showthread.php?t=866006 https://pypi.python.org/pypi/watchdog ...


2

Port numbers don't matter. The applications that are listening or connecting on any port does matter. Use networking to limit application attack vectors. Some suggestions: Application nodes should be accessible on multiple networks with different purposes and traffic profiles : an application network and a management network. Avoid applications on ports ...


14

You're absolutely correct. There's nothing magical about port 80, or port 443. There's nothing inherently secure about one port or another, or even one protocol or another. If you block everything but HTTP, everyone will simply start using HTTP. The attackers can and do always move faster than everything else. They aren't limited by maintaining old ...


9

White-listing is generally preferable to black-listing. If you only open the ports you actually need, and if you limit those ports to the extent possible, then you've reduced your attack surface area and limited the traffic that you need to watch. Yes, 80 and 443 can still be abused for malicious traffic. But, you're also raising the bar for attacks (at ...


23

Blocking all ports except 80 and 443 can be part of a good defense in depth strategy. If it is your only strategy then you are correct, it will be a flawed one. A potential exampled layered approach may be Block all ports at the external firewall minus 80/443 Have an inline IPS (or as part of your firewall) do deep packet analysis Sanitize web-app input ...


0

This was answered at SANS' forensic blog in the comments section, here is the excerpt: QUESTION Are not you running all the commands in this article on your trusted workstation? ANSWER Yes, I'm running them on my trusted machine. However, if I run 'psexec -u' from my trusted machine, it sends the password to the remote untrusted machine and ...


0

A bit dated, but I felt compelled to help expand the discussion/dialog by introducing the idea of blocking broadcast traffic by demonstrating the capabilities of IPTables to filter layer 2 information as well. Specifically, there's the -m pkttype --pkt-type broadcast command line option. Here is an example iptables ruleset that demonstrates this option as ...


1

I found your answer: I want to study it because it amazes me, the complexity, creativity and everything in the field is fascinating, the numerous types of attacks, and so on, it's all very fascinating... If you need something more concrete, add the fact that starting salaries out of a bachelors averge $100k+.


2

This is a very long rant with many assumptions, hypothetical questions, and rhetorical questions, none of which play in to why this attack was 'traced' to DPRK. I would suggest cutting almost everything, and leaving your core question, 'How The Sony Hack Was Traced, and So Quickly?'. Everything else is filler and unnecessary to answer the question. ...


1

By closing unnecessary ports you just decreased your attack surface, which is a good practice. But by running a modern operating system and web browser, you still have a relatively large (or should I say huge?) attack surface. For example, a secure up-to-date fully-patched drive-by-download-immune browser may not protect you from: Vulnerabilities in ...


1

Your key assumption is impossible. A "drive-by-download-immune browser" capable of surfing the modern web does not exist. Even if no known public vulnerabilities exist for a certain browser, there is always the possibility of zero-days. You don't download anything, but every time you visit a website with Javascript enabled, you are allowing arbitrary code ...


2

The thing about a VPN is that the connection between your computer and the VPN end point is encrypted. If you go to Joe's Coffee House and use their public WiFi, depending on the configuration it is possible that anyone in the range of your WiFi radio can snoop on your traffic. Even if Joe has secured his WiFi properly, anyone with access to the physical ...


2

The other address you are talking about is a MAC address, but that is only used at the local link level, not to communicate across the open internet. Only your IP address is used when talking across the internet, however there are other ways to track you. For one, the manual way is to contact whoever has the IP address and ask who was attached at the time. ...


2

You can be detected even using different network devices. If you connect from home using the Ethernet card, and on a Starbucks using the Wifi card, it's trivial to detect you. Now how: Cookies: The cookies on every site you access are independent of the IP address of your computer. So if you accessed Google from home, and accessed again from Starbucks, ...


1

Computers (more precise: their network interfaces) have MAC addresses which isn't intended change (although they also can). It has a different format as the ip, and it is invisible outside of the providers network. State spying works otherway. Practically they use multilayer watching: there are their spy boxes by the network providers, there are by the big ...


1

You don't necessarily need two separate firewalls to accomplish this. Without seeing a diagram of your current network topology though, it's difficult to make recommendations. You mention two separate LANS. Are these logically or physically separated? You mention copying files onto a USB drive and moving the data to a machine on the other network. That ...


1

So what you're kind of describing is a DMZ or demilitarized zone. This is a common and widely accepted way for hosting quite a few different services. Such as Web Servers, Mail servers, FTP servers in a safe way. Essentially for your particular use case and from what you've suggested perhaps using a Dual Firewall architecture DMZ with an FTP server in it, ...


0

In IPSec transport mode, only the IP payload is encrypted, and the original IP headers are left intact. It also allows devices on the public network to see the final source and destination of the packet. With this capability, you can enable special processing in the intermediate network based on the information in the IP header. However, the ...


2

In terms of browsing security/privacy, any time you are over http, your traffic could be (and often is, see cache discussion below) intercepted and fiddled with by servers along the way. Period. You can't be sure if the page you see over an http connection is in fact the page that the webserver sent in response to your web client's request. As far as ...


0

From Cisco: http://www.ciscopress.com/articles/article.asp?p=25477 Tunnel mode is most commonly used between gateways, or at an end-station to a gateway, the gateway acting as a proxy for the hosts behind it. Transport mode is used between end-stations or between an end-station and a gateway, if the gateway is being treated as a host—for ...


2

Yes, however, this is a common pattern. For example, this is how reddit's authentication works and Instagram's. Frankly, the only thing it protects against is sending your password over the network in plaintext. But the process does expose your session and all of your browsing data over HTTP, which just means your session has the same strength as HTTP. A ...


1

Barring unforeseen weaknesses in protocols or implementations of your VPN service, this should give you a reasonable expectation of privacy. All of your traffic that traverses the VPN will be encrypted from your system to the VPN provider. At that point it will travel normally. To your specific question of emails and login details, those should also be ...


0

There are a few more things you need to consider which may or may not effect what you desire to write. Firstly being is that real datacenters with SSAE16 certifications have in place controls and monitors which give a full accounting of all the goings on. Authentication and Authorization. When I go into my Tier 4 datacenter, I am required to use my ...


1

There's a lot of good general security practice information in the other answers, but as I've just been researching for myself the implementation of security in the HomePlug AV spec (used by the devices you mentioned, and many others), I thought I'd add a little more specific info not covered yet. First, there's no such thing as unencrypted data transfer ...


0

If the local network management has control over your client machine, you have no sure way (you can't guarantee, what type of watching software will they use). If they don't: practically, you have to Hide your traffic (to protect from watching on the routers) Hide your browsing history. For (1) the best solution if you have a remote "helper", ...


1

Also most information has to be displayed somewhere, somehow and at sometime. How would you do this without an endpoint? Maybe send it everywhere rather than to one particular host? Why not just use your byod and 4G connection for yourself. Of course, if said network operators are themselves being rather naughty, then they can do your job for you.


3

A VPN or an anonymity network such as TOR can hide the details of your activity from your network's owner, although the fact that you are using TOR or a VPN is not hidden (and may in and of itself be considered suspicious activity). You need to be careful when setting this up, though, since mistakes such as DNS leakage (where your DNS queries go out over ...


1

Or maybe it is bluetooth? I found something like that: Bluetooth PAN and this, which says My Mac reports very similar IP addresses for both, starting with 172.20.10 and differing only in the last octet. It seems like you could be able to get IP address for a bluetooth connection like that. Try to investigate more into it, because from what I saw, ...


0

As far as I am aware, no, it is not possible to be assigned two different MAC addresses simultaneously on the same interface. If you are sure your encryption is WPA2-PSK, an attacker would have to use a word-list to crack your password. The easier your password is, the easier this can be done. Make sure your passwords to both your wifi and your router are ...


1

Keeping in mind that this is fiction, your scenario could work given some qualifications. Perhaps there was some major breakthrough that day in the study, so it was worth the risk to backup the data on demand.


2

If you want a physical threat, you'd need something that would be a threat to data, but not people. Acid corroding the server stack, for example, might be better. Bob could trigger a backup in safety while racing against time to save what data he could before the server was irrecoverable.


3

A fire is a real threat in a datacenter, but it would certainly not be handled with an emergency data backup. Server Fault has some discussion about what to do in a fire; the consensus there was that as soon as it was identified as an actual fire, you press the emergency poweroff button and release the fire suppressant on your way out the door, and call the ...


12

Most things of importance placed in a data center have a sister installation in a physically separate data center, and if there was a reason to "fail over" from the live to the backup site, it's completely plausible that things like data shipping will occur as part of it. It also will result in a flurry of manual and semi-automatic administrative activity, ...


0

You haven't noted the security algorithms in place on the access point, (Edit: just noticed that you did. Leaving the rest of the post intact though) but there are some that are insecure enough to be either effectively plain-text or trivial to crack the password to. 3 minutes seems more than reasonable for an automated attack on, say, WEP. As far as the ...


0

Well, the MAC address prefixes C0:9F:42 and E0:C9:7A are both registered to Apple according to the IEEE: http://www.ieee.org/netstorage/standards/oui.txt, so it's some Apple device, probably. Turn the iPhone off, reset the router, check the address assignments, turn the iPhone on, and See What Happens.™ Alternatively, you should be able to see the ...


0

Possibly not the best wide-usage answer, but definitely answered my problem specifically: Draytek have now released a firmware upgrade for the router that solves the issue with HTTPS sites not getting filtered.


0

If the compromised computer is on a windows domain and the attacker gets system access he can dump local password hashes. So if you have the same administrator accounts on all machines youre entire network is compromised. Also the attacker can lay low and wait for a domain user to log on and steal that password so that probably also gives access to log ...


0

It is unlikely you neighbour can access you router via "public IP". I don't know where you live, but in UK and Italy you need to specifically ask (and pay) for a static IP address otherwise your IP will change virtually every time your router re-connect to internet. However, with a WiFi router, he could connect to your internal network if he did set it up ...


16

Should you be concerned? Not if you weren't already concerned. Spare hardware is common. Giving it away to friends is common. Setting it up for them, if they don't know how to set it up themselves, is common. If you don't want to trust your neighbor, dig out the instructions and reconfigure the box yourself. Is it possible...? Depends, both on how the ...


38

Is it possible to remotely connect to the Linksys device? Yes. Most routers have an online administrator page that can be accessed externally by visiting your public IP address (go check WhatIsMyIP.com too see yours). It's even easier internally by accessing the internal IP address of your router, which is in most cases either 192.168.0.1 or 192.168.1.1. ...


0

In general a compromised device on the LAN is a pretty serious risk to the rest of the devices on the network. An attacker can launch probes from the compromised machine to look for weaknesses in other machines - for example, do you have remote desktop enabled anywhere? File & Printer sharing? A machine that is not fully patched and up to date, which ...


7

It is not difficult to set up a router, so you can easily reset the router to factory default settings and set it up yourself. Look at the back of the router and you'll probably see a small hole labeled "Reset". Stick a sharp pencil or straightened paper clip into the hole and press and hold for about 10 seconds. The router should reboot, and once it comes ...


3

Without a defense in depth security strategy, once the perimeter defense of your network has been penetrated through your compromised server there are a few threats to the rest of your network. The vulnerability exploited by the attacker could be available on other machines on your network, allowing an attacker to move to another machine with ease. A poor ...


0

If you have a VPN tunnel between A and B, that will allow those two servers to have a conversation private from others on the LAN. It does not prevent access to other resources on the LAN by A or B. For that you'd want to look into VLAN tagging or other router based access controls.


2

If you control the network, there really isn't an advantage (under almost any circumstances). What a VPN does is simulate having a leased line from your computer to the network the VPN server is on. If you are already on that network, there is literally no advantage (unless you enjoy encryption overhead). There is one main exception: if you control the ...


0

The advantages of using a VPN is that content you access on the internet and anything sent to a website is encrypted and routed through vpn. When a connection is encrypted it stops people from monitoring your connection. So all data send to website can't be read by anyone except the VPN provider. When a connection is not encrypted a attacker could ...


1

You need to do a risk assessment for each site. and consider likelihood as well as consequences. It could be that some of your sites have a much higher likelihood than others. If this is the case, you could consider slightly modified approaches, such as keeping the high risk sites on their own system and only putting the lower risk ones on the shared system. ...


1

Yes, password credentials can still be stolen through a man-in-the-middle method with SSHv2. The victim profile will depend on the type of man-in-the-middle method used. For your example of arp poisoning from a client workstation, arp poisoning would maximally really grant middling between clients on the nearby local network, or all clients if the server ...


0

Although https (SSL/TLS) is a security layer you really want to use wherever and whenever possible, it is not always available, such as with a lot of chat services. If you enable proper wifi security settings (WPA2) with (one) password that is known to everyone who needs access to the network, each client (and each session) gets its own unique encryption ...


1

Your friend is likely using a network packets capture tool like wireshark or tcpdump to collect data that are transferred from and to your machine. At least to make it hard to your friend you have to use services or websites that offer data encryption which is commonly implemented using TLS, for instance when you are browsing a website make sure the website ...



Top 50 recent answers are included