Tag Info

New answers tagged

1

Rogue access points can certainly be dangerous, but there is a caveat: If the "real" network is encrypted, you cannot set up a rogue access point without knowing the key. Rogue access points must have exactly the same security settings as the original access points, including the same key. If they do not have the same key, clients will try to connect but ...


2

A firewall may work at different layers of the OSI model, going from layer 3 to layer 7 (depending on your firewall). Representing it in a diagram will require to set rules for each layer. I would represent the firewall and include a list of all enforced rules on each layer. Some examples could be: Layer 3: IP filtering Layer 4: port filtering (TCP/UDP) ...


1

As MemCtrl said it could be a misconfigured static settings on the other computer: In my old school there were 20 desktop with static IP addresses. If I assigned to my laptop one of those IP addresses, one desktop showed an alert message like yours. By the way you shouldn't worry about this. Try to consult the University's network administrator.


4

What you mention is referred to as IP conflict. Most probable reason is misconfigured static settings on the other computer, nothing to worry about. Or it could be a DoS as in the router won't know where to forward the packets. In our eduroam infrastructure we automatically block these situations. Consult your University's NOC (Network Operations Centre, ...


2

I remember a case (but not the name of the case) where malware would periodically send blank http requests to big and reliable websites to get a reliable UTC, the malware was designed with a timed bomb on it, set to Denial of Service a specified site at a certain date/time.


0

http://www.lowth.com/howto/iptables-treasures.php And what a treasure it is. IPTables itself has a string module that can do this by looking for strings defined in the ruleset and passing them on. http://linux.blogs.com.np/2008/03/11/iptables-string-matching/ Kernels from 2.6 include support for matching strings present in IP packets, inspecting the ...


11

Simple connection testing is one reason why malware might connect to Google, Yahoo and other search engines, but I would like to present a different explanation. One frequent application for botnets is search engine spam optimization. As you might notice, the result page of Google (and most other search engines) doesn't lead to the results directly, but ...


0

If your Company is segmenting it's Networks based on a risk-zone model you could also verify if the two Networks have different risk-classifications. Somewhere in your security policy it should say: you are not allowed to Bridge two seperate security zones by any other means than a Firewall that only allows necessary connections and is logging and ...


1

You're definitely on the right track refusing this, and there are two main points to why. The first one is more operational, the second is more risk related. Ultimately, however the important thing is to call these risks out and balance them with the cost/benefit involved. If your network already has a firewall and DMZ configured, then it should be easy ...


5

The justification you should give is not a technical one. You should phrase it in terms of risk. Put simply: The corporate network contains information that is sensitive. The systems connected to that network and the and users that use them have a certain level of risk associated with them. The security controls on the corporate network have been ...


6

I'm just guessing here. But it would provide an alternative solution to the problem of name resolution to use a search engine instead of DNS to find a CnC server or to poll for updates and campaigns. It's not clear from the web page if it were simply hitting the front page or running a query - and I don't have tools here to read the pcap files myself. Even ...


60

Most likely, it's just trying to check if there's a working internet connection. The malware authors assume that: Google (or other Alexa Top-1M sites) will be up 99.999% of the time. Traffic going to common productivity sites like Google will not be flagged as unusual. You (or your network administrator) will be unlikely to have blocked these sites at the ...


6

I think I would tackle it in this manner: Why is there an existing separation of the physical networks? By installing another NIC in the server and connecting it to the other network you are in effect bridging the networks, physically and via NetBIOS. This renders the whole point of keeping the networks separate essentially moot. What is the ...


2

In most of the countries I am aware of, network sniffing tools themselves are legal. The law is worded such that acts are legal or illegal, rather than the tools that may be (mis)used to commit those acts. There slight are exceptions to this, in that production of tools whose sole purpose is illegal (e.g. writing malware) may also be illegal, but then it's ...


1

You seem a bit confused about the concept. An open redirect is just a redirect. You browse to http://google.net/redirect?http://stackexchange.com and it tells your browser: please go to http://stackexchange.com. That it is an open redirect means that I can make it send you to anywhere (like an attacker web page), usually by embedding in the link the page ...


0

In concept it is a worthy proposal, but it takes some thought and effort to become effective. If the IT Staff demands this the company must also pay for it, otherwise the user will get the cheapest line and modem/router available and cheap often means insecure in some way. It is inviting a weakest-link situation. Just a separate connection without ...


1

Having the client connect is the standard way of dealing with NATted connections. It can also known as a 'Reverse Shell'. BTW, I know you probably want to write your own RAT, but Metasploit might be a very effective demonstration ....


1

It looks like UDP port 1374 is being used in a UDP reflection attack. This type of attack is possible by simply exposing a UDP service to the open internet. Some UDP services like NTP and DNS, are quite valuable for their role in UDP-amplification DDoS. Exposing unnecessary windows services to the open internet is extremely reckless. I hear an old ...


1

It depends on who "they" are. If you're torrenting, the university can use commercial traffic inspection tools to identify p2p protocols. The tools are signature based, and the signatures are proprietary, so the exact methods used and methods to circumvent them vary. If you're torrenting illegally distributed copyrighted content, then the rights holders ...


0

There is legitimate security value in this configuration, if implemented properly. Whether that value exceeds the cost and complexity would have to be determined on a case by case basis. The security value is this: If work devices (work PC, phone) are on a physically separate network, the devices themselves cannot be attacked by other devices in the ...


0

You can use the open-source Linphone to place secure calls. It supports: HD Audio and video call Secure communications (TLS, SRTP, zRTP) You would need to use a free SIP service that supports authenticating and transporting traffic through TLS (not all do), like Linphone SIP service or Ostel. For detailed instructions on how to set up secure ...


1

Just to clarify, when you say modem - do you mean just that? Or do you mean router or modem/router? Without a deeper understanding of the infrastructure on the employers end, I honestly don't see how having a separate modem will increase security. It's more important that split tunneling is disabled on the VPN client. Most modern home class routers allow ...


1

Beside what you have already done disabling WPS and using whitelisting: Use the latest firmware Disable TKIP, just use AES. Obviously... change default login / wifi credentials. Use a decent password. Disable UPnP. Firewall policies to DROP, only allowing what you are going to use (80,443,22,53,3389...). Limit the amount of DHCP devices, also set them to ...


3

I think there are many factors that could make it a legitimate request: other people in the home who might need network segregation load balancing old equipment (getting a newer modem) VPN configurations I, myself, have made the same request to a certain remote employee to ensure separation of use within that employee's home. Sometimes it's simply to ...


0

Another problem is, that most modern websites requests resources from other hosts (JS libraries from a CND or even from a server controlled by the website owner) and the URI contains the DNS name in the most cases. You would have to know the IP addresses and proper HOST header of all the resources the desired website needs and stop your browser to resolve ...


23

As others have already answered: Yes, Skype originally did sometimes use other Skype users to route some calls. BUT!!! What the other replies didn't say was: This was actually A GOOD THING! Because Skype was initially Peer-2-Peer based not server based (as Microsoft made it) and all traffic was encrypted from end-to-end it gave Skype two big advantages ...


4

As for the other part of the question: why are users sticking with it while there are better solutions? Two words: market penetration. Average John Doe doesn't care about security or abusing (in the olden days) other network users. He just wants to make calls, this just works and he's not going to persuade all his friends to use something else when ...


32

Today, Skype do not route communication through other users machines. This is done by Microsoft servers in datacenters. But back in the days, in the early versions of the Skype protocol, every user with strong-enough bandwidth and not behind a NAT (with routable IP address), can become a supernode and route the traffic of other users that are behind NAT. ...


0

Victim computer has private IP 192.168.1.147 and public IP 10.1.1.44 and attacker has private IP 192.168.0.119 and public IP 10.2.1.54, how do the two computers communicate with each other? Assuming that victim computer has a listener on port 1234 and attacker has connector that connects to port 1234 and takes IP of victim. What IP would the ...


0

A trojan opening a server port is one, but not the only way to allow a remote attacker access. Another method is to have the trojan initiate the connection itself. When active, the trojan will open a connection to a command-and-control server under the control of the attacker, submit information to identify itself and the machine it is running on, and ask ...


7

The attacker doesn't connect to the victim computer, the victim computer connects to the attacker. Data in a connection can flow in both directions, it doesn't matter who initiates the connection in the first place. Once a connection is established the attacker is able to execute commands on the victim computer. The attackers use well-known web protocols ...


0

You can use Entropy Estimation for the stream data. Let's say the payload is encoded in ASCII or ANSI and for printable characters values from 32 to 127 are used . Based on the entropy of the encoded symbols of the stream, you can develop an algorithm that identiļ¬es any text blocks within the payload (in case of unencrypted data) or not. In this case,the ...


2

Do some sort of packet capture. Depending on your level of concern and technical ability you have two relatively easy methods available. If you have tcpdump installed just run tcpdump -A -c 200 if the output is clear text then this is a clear answer. If it is not then possibly your traffic is encrypted. (note: it could just be encoded and not encrypted, ...


-1

In my opinion, some products in the market are too similar. I know some firewalls and intrusion prevention system support this for control purpose. Second, I once heard that Aobo Filter for PC http://goo.gl/xuLdXm can be used to block websites, especially record websites visits in private browsing mode. Then you just need to add URLs to blacklist. I have ...


0

They're saying, "Don't hook up a server with cardholder data stored on it directly to an ADSL modem". In other words, firewalling has to be employed between the Internet connection and the cardholder data environment (and must be employed following the PCI spec).


2

The connections CrashPlan uses are encrypted using TLS. (I've casually seen the traffic when looking at other things.) As for whether or not it's safe: the protocol doesn't really matter, only whether CrashPlan has exploitable bugs in their software, and that's pretty hard to discern without either extensive reverse engineering or access to their source ...


1

There is no good software way to do this. Monitoring outgoing traffic on computer with the camera is no good solution as your traffic stats may be faked. If someone gains such a good access to your webcam to disable the light, faking traffic stats is not a huge step away. You could measure the traffic on your router, but then you would need to read the ...


0

Perhaps the best and only way to determine if your webcam is transmitting images without your knowledge would be to use a network monitoring tool to actually inspect the traffic packets themselves. Just because your outgoing traffic is 1kB/s doesnt mean images are not still being sent -just slowly or broken up. You best bet would be to install something ...


0

Check out the name of the device through Device Manager in windows. When you have the name you can look it up with Process Explorer. Is any process running your device?


3

Many copy machines and all-in-one scan/print/copy/fax machines (especially from HP) have internal hard drives they use for temporary storage. It's been in the news from time to time that people have recovered sensitive data from these drives, either using data-recovery software or by simply reading the drive filesystem.


0

You may also want to check out IronGeek's ARPFreeze tool: http://www.irongeek.com/i.php?page=security/arpfreeze-static-arp-poisoning


3

Is it common for scanners to somehow cache or log documents they scan (on the scanner machine itself)? Yes, probably nearly all which aren't specially designed to be hightly confidential Does scanner driver/software often have temporary folders which end up leaving a trace of the document? Yes also. Can a networked scanner maliciously or ...


3

You are somehow thinking that dead tree docs are less secure than digital copies. I may venture to say you are mistaken in this belief. Digital data may be stolen in a myriad different ways. The scanner may be reporting to HP or other companies/agencies, while your computer may be already compromised. Your computer will have vestigial data on the hard ...


3

According to my research on the subject, and running tests there are no quick fixes for tracking the source individual perpetrating this type of attack because of the nature of it. Meaning tracking, but not filtering/blocking. The attack method itself is basically easy to do compared to the scale of other types of attacks out there due to fundamental flaws ...


0

The general rule of thumb is that if you think that you've been compromised then your trust in the system is no longer there and as a result the action you're taking is what you should consider. With a wireless network it is difficult to tell who is listening in, but that is more likely than someone intercepting your traffic and modifying it. I'd be more ...



Top 50 recent answers are included