Tag Info

New answers tagged

2

The problem with what your asking for is that there isn't a 1 to 1 mapping of the OSI layer to actual implementations. The OSI layers are really conceptual more than physical. In reality, the demarcation between the various layers is very blurred, which makes it near impossible to implement a tool which can break things up and break them into specifric layer ...


0

If it is a known connection(the user has connected to it before) chances are it'll automatically connect to that one and they wouldn't have to enter the password again, but if they'd never connected before, chances are the user will connect to one without a password if they do not know the password to the protected one, because hey, 'free wifi'. Any devices ...


3

Hi I'm the developer who wrote VyprVPN for Mac. It looks like you've still got one of our software components installed. Macintosh applications that needs to alter your system, including VyprVPN, uses something called a "privileged helper tool” aka a system daemon. We install a helper tool with the user's permission, using the appropriate Apple API for this ...


2

Is this kind of activity normal in VPN providers? they are legally registered company, claim that respect privacy... That the domain names begin on dl. (short for "download") sounds like they are checking for updates, configuration files or whatever. That they do it every seconds seems like a waste with Resources, but I Think they do it that way ...


1

How to detect if you are behind a PNAT: nping --ec "public" -c 1 echo.nmap.org (CAPT-labelled packet gives away the PNAT address) If you test the external side of the firewall, you could use the bnat modules from the Metasploit Framework in order to route traffic through the broken implementation of NAT. There is also a vulnerability in some firewalls ...


1

The NAT software running on the Firewall system is going to block all inward traffic that doesn't match a current egress session or a port forwarding rule. If no port forwarding rules are in place, then the server behind the NAT is as good as invisible, barring compromises to the firewall.


0

If you can login remotely, then there will be very little that you cannot do. Once you have a root shell, you can easily run tcpdump. You can read the local databases that supply encryption keys elsewhere. If within that shell, you are missing commands; you can write, or simply go find the commands you want. If you do manage to get in, there is probably ...


1

Any application can easily submit any DNS resolution request. There are numerous libraries available and programmers can choose to perform the resolutions whichever way they want. For example, in Python it's one line of code (maybe two) import dns.resolver answers = dns.resolver.query('dnspython.org', 'MX') To link an actual application to the UDP ...


1

You simply can not assume a program or script is safe solely on their imports. It is to easy to either combine functions or to abuse some 'safe' feature to do something unexpected (like using time queries to transmit data to a command and control server, or tricking the system to running curl with a payload of your data) The only way to know is to do a ...


0

A lot of botnet are actually "commercial" software, in the sense that you have to pay like a licence to get them (even underground commerce remains a commerce... actually you may even find that botnet developers actually offer paid support for their tools!). However, you may find older botnets or versions (ie. software widely known by current anti-viruses) ...


0

Check the router DNS settings. I suspect that the infected laptop changed the DNS settings of your router to use malicious DNS server¹ that return fake entries for pagead2.googlesyndication.com. The virus should not have been able to do that (it should have required a password they don't have), but sometimes routers have holes that allow changing the ...


2

Some things to consider when dealing with TLS as a protocol. The payload of the communicating packet is encrypted. The 'dst' & 'src' packet attributes are not, which allows for any device within the network route to intercept your communication. Numerous attack against the SSL & TLS protocol over the years have allowed for the following attack ...


0

It seems to be a DNS issue, as others have said. Whether your router is infected or was reconfigured by malware is a difficult question to answer. I hope this will at least give you a prtial answer. Investigate your DNS settings. First, open a command prompt. In windows, click start menu, type cmd. Right click CMD and select "Run as administrator" if that ...


-1

An infection of your router is unlikely. ISP's have been known to inject their own ads though. You might want to try changing your router's DNS to use the DNS servers of a third party, such as Google's public DNS or OpenDNS. If you do this and the ads go away, you have isolated the issue. If not, it lies somewhere else.


2

Wireless networks that do not ask for password sen data over the air unencrypted and anyone can : Scan your pc/phone to actively try to exploit a component in your hardware all data via http:// e.g cookies,downloads,images,passwords and email sent Do Arp Spoofing Additionally you can't even be sure that the Wi-fi network is legitimate. That's all i ...


10

an open wireless connection means there is no password exchange required to connect to the network. most data used over an open wireless connection is easily observed. once connected however, there are ways to encrypt your data such as using a vpn. This would allow data to be encrypted over an open wireless connection like public hotspots. though an observer ...


20

Yep. Open wireless networks are entirely unencrypted; anyone can see all the data you send (even if they aren't connected to the network).


0

The site cannot tell directly by looking at your communication channel as they will always see the same connection from the VPN provider so TCP fingerprinting will not work. But if the site was very determined and had many data points to correlate, they may be able to notice some differences in your connections and create fingerprints for the different ...


2

It's a bad idea to host a database server on your internet facing webserver. If the underlying OS of your web/DB server, or webserver platform itself contains any vulnerabilities that can be exploited then your database will be compromised. I won't be broadcasting the IP address of my database because I won't be sending calls to it, which makes my ...


1

Think of the scenarios of compromise. If you host the database on the same system as the web service, then a compromise of the web service results in immediate compromise of the database. So, this is minimally secure. If you host the database on an "internal" server that the web service can access (via an internally facing network interface or special ...


0

I won't be broadcasting the IP address of my database because I won't be sending calls to it, which makes my database inaccessible to the outside world Not knowing an IP address does not make something in that address inaccessible. In an analogy it is a house without a street address. If a thieve walks by that house, he can still enter the door. In ...


1

They cannot infer it from the technical analysis of their communication with you. All they see is TCP datagrams in IP packets, their characteristics shouldn't be impacted too much by your mode of connection (the MTU of the connection might be, but that's a pretty weak correlation).


1

This entirely depends on the infrastructure behind the wireless AP you are connected to. What can be seen more less: Phone Model, Location, Used Services, Used or In Usage Applications (such as application names), Bandwidth usage, Total amount of data spend per application.(both incoming and outgoing), Visited web sites(url list) and total amount of ...


4

Use the company phone for business and keep things separate. Only an optimistic and idealistic person would hope or expect that you will not encounter any issues going forwards. Sometimes you need to keep things separate, this is one of those times, who knows what the future will hold and what kind of situation you might find yourself in where data on one ...


4

Your employer will "supervise" the device by connecting it to a computer running Apple Configurator which will restore it and apply a configuration profile with a certificate in it. That will allow them to push more profiles to your device remotely, and these profiles may include other certificates that can be used to intercept secure connections from your ...


4

From a security stand point, you will generally prefer to have your own device. This just keeps everything separate. Even if you backup your phone and all your data, it is probably better to keep it separate. This also assume that the company permits by policy and by technical controls the ability for you to independently backup your device. You also run the ...


22

Just wanted to chime in and say that the list you have there isn't entirely 100% accurate, but it is close. Keep in mind that this will vary per MDM vendor and mobile OS, but MobileIron can see your location if your employer enables the functionality and you choose to accept sharing your location data. How exactly is this done? They just configure ...


0

If the entire network block is marked as malicious by Google, a lot of innocent sites will end up marked as malicious, as you have seen. If you are sure that the site you want to visit is not malicious, you can navigate to them and nothing bad will happen. That message is just a warning. Your web filtering software (if installed and updated) can protect ...


10

My company is currently going through the process of implementing an MDM for all work phones... So perhaps something that I can help with. The company will install profiles and policies onto the mobile device which (On top of what you have outlined above in image) can enforce the following: Constant VPN connection (Ability to intercept network traffic to ...


-3

According to Google: Of the 148000 site(s) we tested on this network over the past 90 days, 3065 site(s), including, for example, yxdown.cn/, 97sky.cn/, cr173.com/, served content that resulted in malicious software being downloaded and installed without user consent. The malicious software usually is Cross-site scripts (XSS), these are scripts that can ...


1

I solve it for both WPA and WPA2 using MIC_SET, ACK and NONCE fields. MIC_SET | ACK | NONCE | Packet Number 0 | 1 | x | 1 1 | 0 | x | 2 1 | 1 | x | 3 1 | 0 | 0 | 4 Where with x I indicate that the NONCE has a value different of ...


2

There is a specific IETF RFC that addresses spoofed BGP source prefixes being advertised into a network. For an ISP the default is to trust the other ISP and it is up to your peers to enforce this rigorously and some do not. https://tools.ietf.org/html/draft-jdurand-bgp-security-00#section-4.1.2.2


1

This answer assumes that the adversary does have access to run-of-the-mill scanning direction finders (an example). Also, the adversary is sure to detect your transmission (otherwise, you'd be talking about LPI radio comms). For a "successful" transmission without being pinpointed to a single (true) location with some guaranteed accuracy, you have to know, ...


2

There is no way to transmit data wirelessly without being susceptible to trilateration (using the standard definition of "radio wireless"). That's why attempts to "transmit data without revealing your location" usually end up shifting to things like laser, infrared, or other visible light methods. These things tend to work well in directional applications, ...


1

I would advocate terminating SSL at the load balancer (be that on your network, or at a CDN provider or whatever). It means the LB can inspect the traffic and can do a better job of load balancing. It also means your load balancer is responsible for dealing with slow clients, broken SSL implementations and general Internet flakiness. It's likely your load ...


1

On the one hand, as it has been stated, I think that the DDoS risk is definitely not the reason why you should block ICMP. On the other hand, if ICMP or DNS is allowed, you can open a tunnel with a remote host over this protocol and totally bypass the captive portal. If those protocols are not blocked (or at the very least monitored), you basically have ...


0

I don't know where to you get the information about ICMP as the main cause of DDoS (I really doubt it), but There must be a way for the client to access the capture portal, because otherwise login would not be possible. Which means that the client can send data to the capture portal and that these data gets processed there. In this case it does not matter ...



Top 50 recent answers are included