New answers tagged

0

It is actually expected that they would all have the same MAC address - MAC addresses do not survive the hop from router to router, so what you are seeing is likely the MAC address of your ISP's router (the closest MAC to your router).


1

I had this same issue about 2-3 weeks ago, with the same site coming up after running several scans with Roguekiller. Prior to that the browsers would lock up or work very intermittently, (Firefox, Chrome, Edge, IE , Opera, ect.) Using a web browser in a game, running a VM or Tor worked, but even Tor would lock up after an hour. This was on Win 10 64bit, ...


0

It's difficult to tell just based on this. More information would be needed to make any solid conclusions. If you really want to tell if it's compromised; reboot the system, use netstat to view any active connections. If a rootkit is installed, then you should see an unrecognized connection. The hard part is weeding this connection out amongst all the ...


3

If you are looking to map out your immediate LAN, a simple ARP sniffer (probably written in Python with the scapy library), would work just fine. But, if you're looking to find the entire network topology, there is a way to do it, but the circumstances are a bit specific. If the network utilizes Cisco routers, and those routers route dynamically using ...


3

Some background information for context : Some organizations save full-packet captures for their high-security or production networks. There are commercial products which do this too. People definitely do what you are talking about but not always for the reason you mention although that's a good side benefit. Ideally what you want is an optical tap at key ...


10

If you router offers a real DMZ then the rest of the network would be safe even if your Windows PC is compromised. A real DMZ is a separate network which has no or only very restricted access to the internal network. But, what most SoHo routers call DMZ is actually an exposed host, i.e. traffic from outside is forwarded to a single host inside the internal ...


2

You are correct in that UDP does not have a state like TCP has, so in a literal sense there is no session to hijack. However, because of this it is impossible to verify the identity of the sender of an UDP packet. All you have to go on is the sender IP in the UDP header, and that could trivially be spoofed. In that sense, it is easier to session hijack UDP ...


2

You have almost always timeout on inactive TCP session implemented in routers, switches and all that low level network machinery. It has little to do with security in the sense of protection against a deliberate attack, but just try to not exhaust resources because of buggy software failing to close connection, or other hardware errors in external network ...


6

As you may have noticed this has nothing to do with security whatsoever. Instead, the practice of killing long-lived dormant TCP connections has to do with bugs - it's a work-around for buggy software. One of the more famous examples of software leaving TCP sessions hanging is Internet Explorer (at least up to version 7). IE had the habit of not ending TCP ...


2

Universally Unique ID v 4 with device pre registration sounds about right for this sort of application. When a device is in the factory you flash it's firmware with a UUID in it. Then you register that UUID with the DB. If the UUID exists, you generate and flash a new one. This should be exactly what you want because now if someone grabs a device, they have ...


1

Authentication, authorization, and accounting (AAA) is a term for a framework for controlling access to computer resources, enforcing policies and auditing usage. RBAC (Role Based Access Control) is a way that dictates how a subject can access objects. Two other forms beside RBAC are the highly restrictive mandatory access control model (MAC) is compared to ...


49

I'm completely confused, though. What is the security benefit here? Nothing. The most likely scenario is that something in between is timing out the connection after 5 minutes to conserve resources. That could be a firewall, a WAN accelerator, an SSL accelerator, etc. Or it could be just a bad default setting. Who knows? Network admins often have ...


0

I'm assuming you're talking about configuring Cisco equipment here (based on the aaa new model remark). You can use AAA there to map (groups of) users to specific privilege levels. You can assign a set of allowed commands to each privilege level. This makes AAA on Cisco a form of RBAC.


13

I'm completely confused, though. What is the security benefit here? It might not be a question of security but have a different reason. Unfortunately your question only offers your view so we can only speculate what the real reason might be. One explanation might be that there is a simple stateful packet filter where the states time out after 120 ...


28

This sounds like a good example of a security "cargo cult". A security control has been implemented blindly without understanding the context involved or indeed implementing it correctly. Generally speaking in security the point of an idle timeout it to reduce the risk of situations where a client machine is left unattended and a malicious user gets to the ...


0

A switch is something which forwards packets unmodified between devices inside the same network. A router is something which forwards packets between networks based on routing rules and will also modify packets, i.e. decrease TTL inside IP packets. For a more detailed comparison see Cisco: What is a Network Switch vs. a Router? which also has a nice compact ...


3

If you used a LiveCD and never/rarely went out of your way to get a new one, yes it would eventually contain old and buggy software. However, the point of the LiveCD is that there is nothing saved in a nonvolatile way, so even if you do manage to luck out on your "risky click of the day" and the browser downloads some malware, all you have to do is hit the ...


6

There is a potential risk in using old versions, but in many cases this risk is less significant than the risk of using reasonably patched system which has all sorts of dubious software installed, and may possibly contain malware. There are of course distributions dedicated for use as a live OS dedicated for doing such things as banking. They are hardened by ...


16

Potentially, yes. That said, many distributions (e.g. Debian, Ubuntu) run package versions which are extremely out of date (years) with few backported security patches, and most people do just fine. You're also usually only exposed on the network you're immediately connected to, so if you're only using a trusted LAN then it's not so much of a concern. ...


0

I would like to know what else can I do to improve my security? First of all, you should make sure you use the newest firmware for your linksys device (if you use it). I wouldn't recommend to connect your Windows PC directly to the internet. Doing so allsows a potential attacker to directly "access" and gather information about the target machine ...


0

My recipe was and is : Portsentry Proper firewall Retailating NMAP Auto-mailing via Perl scripts to abuse@xxx from whois from reverse DNS Auto-reporting to blacklists for malicious IP's Enforcing a list of bad IPs to HTTPS/SMTPS/IMAPS/POP3S It worked and it works, but it took some time for assistance


0

I will assume you are talking about the number of hops between machine A and B. You cannot assume that this number of hops is identical from A to B and from B to A. You cannot even assume this number is the same from A to B for 2 different packets. Routing information can change overtime.


1

You are asking for a comprehensive list of security concerns that a company might face. This question is way too broad to be answerable because security is a huge and ever changing field. That said, I'll try to give an answer that at least introduces the size of the problem. Just thinking about software for the moment - you should start your security review ...


-4

Viruses and malware Whether from malicious emails or websites, employees may unwittingly download something nasty. This can do something as harmless as serving up unwanted ads, or something extremely costly like encrypting everything on your network and demanding a fee to de-encrypt it (ransomeware). Less likely but still a concern, malicious code may be ...


0

There are some great answers on architecture and correctly designing a network already, so I won't address those. What I haven't seen mentioned is watching for data exfiltration methods. If someone is inside your network, ostensibly they are looking for additional hosts they can compromise and data that might be useful to them. (Credit cards, ...


0

First and foremost, you would never allow guests to access your network. A separate network should be created for them. But let's go with it. So you have a flat network of systems (doesn't matter if they're servers, desktop, etc., everything is flat.) Do you have a documented network? Meaning, do you know what systems are supposed to interconnect with what? ...


1

While the duplicate that people have linked to does cover most of the story, there's actually a way to make MAC filtering work: enable client isolation. Client isolation prevents individual WiFi clients from communicating with each other, effectively segregating their traffic. Since in order to know the MAC of a legitimate client you'd need to see traffic ...


1

As you said, MAC filtering provides an extra layer of security, as the potential attacker would need to spoof his MAC address (something we would do anyways if he doesn't want to get caught). To provide a good security for your Wi-Fi you should have MAC filtering enabled (with a white list), DHCP disabled with fixed IP for your devices (if possible), WPS ...


1

MAC addresses are only relevant to the nearest hop. So you can only spoof a MAC address within a LAN. That means that someone wanting to get around any restrictions needs to connect to your network, or to a network which is directly connected to your network. i.e. the attack surface is reduced. Like port firewalling, MAC filtering is a great way to cut down ...


0

A MAC address filter provides no real security, but it does provide a false sense of security. It should therefore be considered harmful. If you need to limit access to certain devices, use WPA2. If a single pre-shared key is not sufficient for your purposes, it's not that hard (ok, ok, famous last words) to run a RADIUS server and use enterprise auth. I ...


2

You appear to have answered your own question. An advanced user can spoof a MAC address, but non-advanced users cannot. MAC address filtering provides limited access to those who do not have the skill to spoof a MAC address.


4

MAC filtering doesn't provide an high security. An attacker can simply see which devices (and their relative MACs) are connected to your network, and spoof one of theese MACs. When he changes it to his machine, he can connects to your network without any problem. In conclusion, MAC address filtering doesn't increase your security.


4

This object type is not readable for human. Why should it? It is intended for a computer and not for a human. I've never seen this kind of security. Is this general dev stack? It looks very safe. I doubt that this is primary a security feature. My guess is that they use some higher level development tool which just generates this kind of stuff. ...


3

She pays for your internet. Many providers offer plans "for kids" with parental control, including full reports of visited resources. Using those is the easiest and most obvious option for computer-illiterate person. Changing PC or other hardware won't help of course as long as you use same internet access. If your PC is free of non-standard security ...


4

Others have mentioned shared profiles, known passwords, and google history, and the ways to resolve those. But even more likely is: what do you get if you google your name, plus the word "youtube"? Do you get the videos she mentioned, because those are the ones you have commented on using your account? That is to say - perhaps she is not spying on you, ...


1

You can run a local machine as the web proxy and point all others to use that for all http traffic. Squid is one option. Another option is to setup one machine to be the DNS server, e.g, using bind. You can then collect all the DNS logs. You can set up your router to give this local DNS machine as the primary DNS server via DHCP. Another way (albeit the ...


1

If you give a guest a wifi password, they can share that password though obviously you could politely ask them to not share it. The only way to prevent that is never share one global wifi password with guests you do not trust. The best practice would be to maintain your home wifi network (secret password, never give to others) and a shareable guest network ...


0

Actually, you have two options: guest network - fast and dumb solution. It can be reconfigured as many times as you need, but it will require you to re-provide the credentials. But it can be an "isolation layer" that will properly separate your Wireless devices from aguest ones. MAC access control - a little elaborating, but secure solution if applied ...


0

Here are some options: You could buy an additional cheap router, and turn it off and on whenever needed. You could add Network Access Control, you could configure your existing router to ONLY accept your devices' MAC addresses. When a guest comes in, add his MAC to the list, ignoring all unknown MAC addresses, and remove their MAC when they leave. Or you ...


0

What you want is an AP that offers some sort of Guest Network functionality. This would allow you to give out the wifi password, guests can then access the internet (since they probably have no business talking to your devices directly) and then every few days you can reset that password to the detriment of anyone else who might know it at that moment. ...


9

First thought that came into my mind is shared browser user, maybe you have used computer at home with your account, and then did not sign out? For example, if you use Chrome, all your browser history is being synced between all of your devices, including your moms computer. You could use a different browser, and some kind of VPN to ensure that your traffic ...


4

You could use Tor, or maybe simply a VPN, for no more time than necessary to find out if she still knows what you've been browsing. If positive, you have determined that your computer is compromised. Now: Make sure there are no weird pieces attached to it (there are hardware keyloggers). Format your hard drive and do a clean install of the operating system ...


83

One possibility that I came across by accident: Google (and possibly other search engines), keep track of what you search for, if you are logged in. Anyone with (access to) your login name and password can access your search history. This includes any computer you logged in to Google on (e.g. if you accessed your Gmail from your mother's computer). I do ...


25

Sorry if I'm stating the obvious, but: Why don't you ask your mother how she's doing it? Or someone at the uni, if your mom is not cooperative? Or, if you receive support from a social worker, ask him/her? Or, if all the above fails, a sufficiently trusted computer-literate friend who can gain access to your computer (if the monitoring is device-based) or ...


182

Be careful about assuming too much. You say that you know "surefire" that your university is spying on you, but your only evidence is that your mom is computer illiterate and you're "sure some of them know more than they should" about you (WARNING - this is a red flag for those of us not in your situation, you do indeed sound extremely paranoid). If you ...


0

Given the current information there are a lot of possibilities how this could happen. Try to eliminate a few. Do you have a mobile device with a separate data plan that is not paid by your mom? If not you can get cheap prepaid ones for like 10$. If you have a mobile data plan do all your surfing on your computer for some time over this mobile plan by ...


3

I say that you haven't given us enough information to identify how this is done. Your mother's lack of technical literacy may not matter much as long as she knows somebody (or knows somebody who knows somebody) who was willing to lend a hand getting a solution installed. Perhaps, also, it's not your mother who is spying on you, but someone else (with more ...


3

If you want to be sure that you are safe, reinstall your operating system from a clean (stock) image. Then turn on 2-factor authetication for all possible services (Google, Facebook) and change all passwords (including your mailbox password). Against network traffic spying you have to use VPN connection - it encrypts traffic from your computer to the VPN ...


75

This sounds like it would mostly likely be some kind of Internet monitoring software (a.k.a legal spyware) installed on your computer when you set it up. Some ISPs provide this kind of service either network blocking or device monitoring (e..g this article from the UK). From the statement that they can view HTTPS connections, we can rule out just standard ...


10

Was your computer supplied by the university, or using a university OS image, or custom network access software? You mentioned you're not using the university network, however if you have their network monitoring software installed, then they still could see your history. It's unlikely to be your ISP. They don't typically have the resources, or inclination ...



Top 50 recent answers are included