Tag Info

Hot answers tagged

13

Blocking Bittorrent is challenging, and can't really be done effectively with port blocks. The standard ports are 6881-6889 TCP, but the protocol can be run on any port, and the peer-to-peer nature of the protocol means that discovering peers that use unblocked ports is simple. Blocking Bittorrent traffic could be done with a deep-packet-inspection or ...


11

Convenience: Offering good codecs NOT Preventing DVD players from fast forwarding through FBI warnings and 15 minutes of marketing Easy distribution: kindle, itunes, etc Allowing fair use: CSS (DMCA), moving between devices, no region locks, etc Reasonable pricing for electronic goods If there is more value in buying the good then downloading from ...


11

One tool for trying to enforce DRM is watermarking, i.e. embedding within the media itself a mark which is (almost) invisible to the human viewer, but which is resilient to copies (i.e. the copy has it). Once media copies are individually marked with the identity of their rightful owner, you can trace the origin of fraudulent copies. Do not get it wrong: it ...


11

This is a bandage for a much larger issue... When I setup networks for small offices (50 clients or less) I'll use a business-class (entry-level) wired router such as a Fortinet Fortigate 40C or a Cisco RV042. You can block traffic based on: IP - Addresses and Ranges FQDN - Fully Qualified Domain Names Geography - You can block access to countries if you ...


8

For signing only, a 512-bit RSA key ought to resist at least a few days, more probably a few weeks, even against determined attackers. This is still "reasonable" as long as you verify the signature "soon". You can imagine that from the point the public key was made public, you have a few minutes, at best hours of security, after which you must consider the ...


5

The Digital Rights Management (DRM) question has been around for a while. The simple answer is: No - anything which one individual has can be shared Have a read of this question, and the others tagged drm for some discussion. Most of the protection that is put in place fails, on many levels: Identifying files through checksums or signatures - these can ...


5

You've got most of the likely approaches mentioned in your question but here's a couple of points on them. Usage. This is the easiest way to start blocking traffic, and what the a lot of ISPs seem to go with most. Have a "fair use" policy which is based on bandwidth and then start taking action against users to go significantly over it. Unfortunately in ...


4

ISPs have never been involved in the process of determining weather or not specific traffic is related to a Copyright violation. From a technical perspective the ISP is one of the worst places to impermanent such a monitoring system. (There is a huge amount of traffic flowing through an ISP, and huge number of possible copyright violations. At best case ...


3

I assume that they would do this by sniffing packets, but doesn't this all go down the drain if packets are encrypted? I'm trying to think of how they can detect this kind of activity if packets are encrypted. I suppose that when the encryption key is sent over a BitTorrent client, the ISP could intercept the key and then see everything. Would ...


3

If the P2P software isn't explicitly designed for privacy you should assume that it does not provide any privacy. Some of the data that you are likely to leak when using P2P software might be: IP address Any personal files you accidentally share Any data you provide to the P2P software (e.g. username) Any data wilfully provided by the P2P software (e.g. ...


3

Many P2P software will create hashes of each piece to prevent a malicious entity from modifying the pieces in-flight. When your P2P client gets a piece, it verifies it's hash. This will prevent one malicious entity modifying a piece of a valid file, but it won't help you if the file itself (qwerty.mp3) is malicious. If the file itself is malicious, a simple ...


3

Real-life certificates have a neat concept called revocation. It is a way to propagate (in a secure way) the information that a given certificate, though apparently legit and kosher and with all the correct signatures, should not be trusted anymore. That's a kind of "oops" functionality. In X.509, this uses Certificate Revocation Lists and OCSP. The ...


3

In practice, unless each mobile contributes bandwidth and storage space to the P2P network, a P2P network will involve computers other than the mobile applications of your use case. And thus susceptible to a security topology beyond your control. If the network is pure P2P (no central servers other than peer discovery bootstrap) and it is restricted to the ...


2

I think you really mean you're looking to combine DNS data from different servers rather than different protocols? Most DNS servers allow you to declare records for a local network (and if, say, you define an authoritative record for google.com then clients configured to use only your DNS will see your records). Or do you mean different DNS servers? There's ...


2

I'll assume you're talking about BitTorrent, rather than Gnutella or other P2P protocols. There's no standard port for BitTorrent traffic, so you're going to have to do some digging. First, BitTorrent talks to a set of trackers. This communication is done over HTTP, and will have (at least) the following headers: info_hash - a URL-encoded hash of the ...


2

That's the worst possible advice; and, doesn't answer what the OP wants to really know. If you get a standard VPN provider and you attempt to forward your ports via your Internet router, you're leaving yourself completely exposed to "real" malicious attacks; especially if you forward common ports such as port 80, 443, etc; even if they're SSL'ed! I tested ...


2

The growing popularity for Torrent proxies is for anonymity. You can encrypt traffic all you want, but it can always be traced back to the public facing node. The contents of your communication will remain private, however it can be identified that your IP address was in communication with a remote IP address. Without a proxy that will trace back to either ...


2

If the protocol is not designed to protect your identity from peers, you should assume it doesn't. For ADC you'll get the IP address and date/time, which is enough to be identified by the ISP. MAC addresses are layer2 addresses and don't route. Sometimes you can determine them because of leaks in higher layer protocols (e.g., SMB), but any reasonably ...


2

I think what you are looking for is Scapy. It can do all you request and more and is under active development. "Scapy is a powerful interactive packet manipulation program. It is able to forge or decode packets of a wide number of protocols, send them on the wire, capture them, match requests and replies, and much more."


2

As far as I know pfsense performs very simplistic traffic shaping where by it prioritizes traffic based on port range. This is just so that you can play games with someone else using BitTorrent on the network. This is just to be friendly, this is not for "security". Trying to filter all BitTorrent traffic at the gateway is very a difficult problem and a ...


2

Typically, based on the p2p client used, as @mgjk has mentioned, whatever data is available to the client can be leaked. To answer your specific questions : IP address - This is definitely leaked, since it is needed to create the connection in the first place (different story if you're behind a proxy) MAC address - Even if the client used has access to ...


2

Time isn't that important. The question is how much money that attacker is willing to spend. From what I heard, breaking RSA 512 currently costs 75-150$ and 30 hours using cloud computing. We have a very similar question on crypto.SE: Is 512-bit RSA still safe for signature generation? But have you considered using elliptic curve crypto? For example the ...


2

The general metrics is that the key space should be big enough that the key cannot be guessed within the time the transmission should be protected. I'm afraid I don't know off the top of my head what the average time to brute force a 512 bit RSA key is with current computers.... but that's the value I'd be looking for, and then compare that to how long you ...


2

DNS resolves domain names to IP addresses. IP addresses are the endpoint identifier so that TCP/IP can create a connection from the source computer to the destination computer, therefore has to be available for the protocol to use. Hiding your IP in the final connection is like asking your mailman to use ESP to read where the letter is supposed to be ...


2

You can't really keep your IP private if you're using a torrent on the open internet. The reason for this is the way the torrent protocol works. You aren't downloading directly from the server; instead, you are downloading from other downloaders. In order to get a file from said downloader, you must have some way to contact them - that is, an IP address ...


2

Perhaps you could run the p2p programs on a proxy, download the whole file (this is the first time you're going to see it and be able to fully virus scan it... the p2p transmission is irrelevant), then scan it and serve it to the user. Easy way: web UI for people to search, request & download. Hard way: intercept from p2p clients and pretend to be the ...


2

I think the reason this question is difficult to answer is because it is the wrong question. You cannot evaluate appropriate expiration times in isolation from the 'thing' being protected. There are no absolutes here. What you really need to determine is what is the maximum expiration time we can accept as being long enough to achieve maximum convenience for ...


2

I can think of several methods, not necessarily independent: Fully homomorphic encryption, the ability to securely compute on other machines without revealing the data, and possibly without revealing the program itself. HElib, a FOSS project by IBM Scarab a FOSS project, though impractical/slow, it is a good demonstration Secure function evaluation, see ...


2

There are 2 main types of NAT, you can have one to one NAT (static NAT) where one internal IP address is translated to one external IP, and you have many to one NAT (hide NAT) where many IP addresses map to a single IP address. In many to one NAT when an internal host connects to an external host the IP information is put into session tables (I'm using this ...


2

If I understand you correctly, you're asking if the process you've described places the security burden on the hash algorithm, hence the question about how good hash algorithms are. Well scrutinized algorithms (like SHA1 through 3) should be very good, in that creating a collision should be extremely difficult. However, from reading your process, I think ...



Only top voted, non community-wiki answers of a minimum length are eligible