Tag Info

New answers tagged

1

Here is how this really works. Where ever you are your IP address on a Smart phone may, or may not change. This purely depends on the carrier and or provider of said access. Some will give you a static Ip, others will give you a Dynamic IP. Static does not change, Dynamic does. (If I am remembering right I am very tired.) So, lets say you retrieved ...


2

Setup proper 802.1X authentication / WPA-Enterprise to connect to the network. So each client will have their own credentials and they'll be logged accordingly. VPN could also be set up in the same manner if you need remote access. All of these protocols are designed with security in mind and thus inherently prevents any form of MITM attacks if implemented ...


0

If you want to ensure you have your employees taking to you, and not some third party, you need to create a set of keys you distribute securely, and the tool you use depends on both ends having keys. Some few VPNs may do that, but not many. I think ssh can do so.


1

To answer question 1, I don't think either setting is as secure as you ought to be. Option 1 leaves masq turned on for the WAN when it doesn't need to be. Option 2 sets up a default accept rule for the WAN when it doesn't need to be. To answer question 2 and fill in the blanks on question 1: The input/output rule settings in OpenWRT are the default ...


1

Check out these two guides for more info: http://blog.ipredator.se/howto/openwrt/configuring-openvpn-on-openwrt.html http://tokyobreeze.wordpress.com/2015/01/15/install-openvpn-in-a-router-with-4mb-flash/ The basic idea is to create 3 separate zones, use zone forwarding from LAN to VPN, and turn on Masquerading and MSS clamping on the VPN zone. Be sure to ...


0

WPA2 is just a commercial name for a complete implementation of the 802.11i specification (WPA implemented only a part of it as a temporary measure against WEP weakness). 802.11i is an amendment to the original 802.11 specification, which means that it replaced several part from it, the original content becoming deprecated and a new revision of the 802.11 ...


0

VPN providers surely keep track of your connections to their services. They probably don't track your trafic inside the tunnel, giving you the anonymity. Remote port forwarding only applies for incoming external connections and therefore doesn't remove your anonymity for your outgoing trafic. But, if you use remote port forwarding to handle illegal ...


2

This is based on personal experience with a femtocell issued by the German chapter of O2 (a branded Alcatel-Lucent 9361). For other femtocells and operators, the configuration might be different. Setting up a Whitelist of Cell Users By default, every O2 customer (and those roaming from other operators and countries, of course) is allowed to connect to ...


1

You could use an SSH tunnel, which would encrypt your network traffic and route it through your home. The problem is that you'll likely not be able to access local network resources (fileshares, intranet, etc.) while tunneling. And while your net-admin may not know exactly what you're doing, he or she will still see that you're doing something. It may rouse ...


0

Just don't do this. Even if you are constantly deleting all forensic artifacts related to your browser's history, your workplace probably has a web proxy or firewall with ability to track your activities on a network level (away from your computer). Everyone has a smartphone on them they can use for their personal web browsing while at their desk. If ...


1

In the old days, if you were a big company with multiple private local networks in multiple locations, you connected them together by installing private data lines between the various locations to make a Wide-Area Network. Then the Internet came along, and you also had to connect each site to the Internet. It turns out that Internet feeds are much, much ...


1

There are low tech solutions that will work: Possibly combined with an IR repeater: if you want to limit the remote control to, say the front of the room where the teacher stands. That won't help if your teachers want to stroll around the students and operate the Beamer; as @AJHenderson says, there is no security protocol for the existing remotes. ...


2

In basic language we can say VPN provides access to private network (corporate / office ) from outside, using secure network connection over the public network (Internet/ISP). Types of VPN: Site-to-site VPNs connect entire networks to each other -- for example, connecting a branch office network to a company headquarters network. In a site-to-site VPN, ...


-1

VPN is a network that is constructed by using public wires — usually the Internet — to connect to a private network, such as a company's internal network. There are a number of systems that enable you to create networks using the Internet as the medium for transporting data. These systems use encryption and other security mechanisms to ensure that only ...


0

You are mixing several different concepts here: VPN (Virtual Private Network) A set of techniques to make connections between 2 networks through a unsecured network. like a laptop that connects to the private corporate data-server through the internet, utilizing a VPN connection. A (Web-)Proxy, A Machine that sits in the middle between you and a server and ...


0

I would suggest you to try scapy, if you're doing it on linux. It has great features for the case you need. https://samsclass.info/124/proj11/proj16x-promscan.html


1

The seminal work on detection of promiscuous interfaces on the network is Detection of Promiscuous Modes using ARP Packets: ...promiscuous mode detection is performed by checking the responses of ARP packets, when ARP request packets are sent to all nodes on the network I don't know of implementations offhand, but the paper is detailed enough for ...


1

The Internet is a wild place; there are tons (as in, hundreds of thousands or even millions) of script-kiddie bots constantly scanning every single IP address looking for open ports they can connect to or unsecured servers they can exploit. This is most likely likely the kind of activity that you're seeing. Fortunately, the vast majority of consumer routers ...


0

As long as you trust people / computers accessing your network, your printer isn't a big problem. The main security hole is the HTTP-only access, which means that when you manage the printer using it, someone 'may' grab your credentials. And then ? This could only be achieved while you're managing it through the WiFi, not while connected on your ethernet ...


0

Seems like there is something blocking your egress traffic. Are you configured to use a proxy, such as a web-protection proxy? Try sending HTTP/TLS packets through it with ProxyChains -- https://github.com/rofl0r/proxychains-ng/ -- but using only connection-oriented and non-pinging Nmap flags (i.e., -Pn -sT). Does the traceroute (i.e., --traceroute) Nmap ...


3

It sounds like what you have there is a VPN option known as "split tunnelling" set-up. In this configuration, traffic for your home network is directed over the VPN and all other traffic goes straight to its destination. If your goal is to protect all your general traffic from sniffing attacks in the coffee shop or other location that you access it from, ...


3

These shares are call "administrative shares". They are there to enable the smooth working of pretty much all network management tools. They aren't a security risk unless you explicitly make them one: by default, they aren't accessible but by an admin account and such an account and local admin accounts can only be used remotely if they have a password ...


0

Just remember the fact that 'end to end' encryption doesn't necessary mean that every single link needs to be encrypted. E.g. Payment request is encrypted in client browser using app-3 public key. Corresponding private key resides in a HSM. Client Browser (encrypted payload) -> reverse proxy -> web -> app1 -> app2 -> app3 Payload is decrypted in app3 ...


10

A combination of two USB drives and a hub might be a good solution Use the write-protected USB drive for any data that you dont want to get sabotaged and the other USB drive for anything you want to save and take with you home.


5

If you are only concerned about write operations, you could buy a cheap SD card and a USB reader. SD cards have a physical "Write protect" switch on the side. You may be able to find physically write-protectable USB drives too. If all fails, use a good ol' DVD.


11

Seems pretty obvious that you could just disconnect the network cable. Plug in the USB, Dump/Upload files, eject the USB, then reconnect to the network. This should prevent them from having any kind of access to the drive (read or write) Unless they own the computers AND have some mechanism to download everything on any connected usb device (which is ...


30

You effectively can't. If you're on somebody else's machine and they have administrative rights to it, then that's the game. The quite fancy answer be mandatory access control systems like SELinux which hold a concept higher than root that would at least require a reboot and direct system access to change the settings.


1

No, the purpose of a sniffer is to capture all packets, unless a filter has been applied at capture time. Using a new protocol might mean the data can't automatically be rendered or analysed with more effort, but you will find they are all still saved to the file. All the sniffer is doing is analysing captured data in the same way a router or gateway would ...


-1

So the thing here is to go spelunking around the switches to isolate the location of the source. You could figure out a window period where this is happening and focus your efforts there. If it's in a regular interval, then that's a great thing. Anything else, is a pain.


0

I blocked the offending MAC address, and in the past year never got a complaint from a user, so that seems to be the fix.


1

Your question is a little vague, so I would advise that you consider what threat models you're trying to protect yourselves from. The first thing to do is to define that a DMZ is a region in your network which is considered wholly or partially untrusted, because it is attached to the Internet (or some other untrusted and hostile network). The DMZ defines a ...


-3

It is better to NOT use a DMZ at all. but if you must, assume everything in the DMZ is compromised and should be distrusted and assumed leaked to others. therefor the best solution would be to move your DB and webservice outside of the DMZ, and employ a reverse proxy inside your dmz. (and make sure the webserver can only talk with the proxy, and the DB only ...


3

All your client side security efforts are doomed to failure. Obfuscation and hiding your source just isn't going to work. The more valuable the data you are working with the sooner your code is going to be reverse engineered. The only logical approach to consider everything client side public. Your approach should be to focus your security on server ...


1

A better way to protect against cryptolocker is to set up a NAS, that will force versioning of files. With force, I mean that all Changes of files will be saved on the NAS, and the client has no way to affect this. Then you save all important data on this versioned NAS. If the cryptolocker encrypts your NAS, you simply tell the NAS to rollback the files ...


1

Since a virus infected PC has to download (encrypt) reupload the entire file, and repeat the process for every network drive, is is possible to detect this unusually high bandwidth event? Is there a way to respond to it (via QOS or something?) You're mistaken: the malware doesn't need to transfer the file. It uses asymmetrical encryption: the file is ...


0

For testing firewalls, I generate my own scripts using hping. One of the options is to fragment traffic (-f) and you can set the data size (-d).


0

Ok Break your Question with its solution into parts. PortScan There are some configurations that you need to change to enable nmap portscan open the snort configuration file with sudo gedit /etc/snort/snort.conf. uncomment and modify this line ( #428 usually ) : Portscan detection. For more information, see README.sfportscan preprocessor sfportscan: ...


1

I'm posting this new answer to my question because one part of my original question was not completely addressed. Specifically, what kind of tool could be used to make so many connection attempts, seemingly more quickly than the minimum delay time I had set in my pam configuration. Well, it looks like a tool like hydra (see www.thc.org) was used. To check ...



Top 50 recent answers are included