Tag Info

Hot answers tagged

45

This is not a security risk. The router looks in its ARP table to find the MAC address of your IP address. The reason it can do this, is because you are connected to the router via layer 2 in the OSI model. The router simply looks up your IP address in the ARP cache to find its MAC address. A website on the Internet is not connected to your LAN and will not ...


36

MAC filtering is not a part of the 802.11 spec, and is instead shoved into wireless routers by (most) vendors. The reason why it's not a part of the 802.11 spec is because it provides no true security (via kerckhoff's principle). In order for wireless to work, MAC addresses are exchanged in plaintext (Regardless of whether you're using WEP, WPA, WPA2, or ...


30

I tried to filter Google results for "message opened by mailclient" as follows: Jan 1, 2008 – Jan 1, 2009 Jan 1, 2009 – Jan 1, 2010 Jan 1, 2010 – Jan 1, 2011 Jan 1, 2011 – Jan 1, 2012 Jan 1, 2012 – Jan 1, 2013 Jan 1, 2013 – Oct 31, 2013 Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after ...


20

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


18

After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js. So, the message message opened by mailclient ...


16

The two are functionally equivalent - the DMZ is effectively in a sandwich, as it has to have connections from the outside world firewalled, but also have firewalls restricting access from it to the internal network. While the latter diagram is often what happens (for cost reasons - you need less firewalls) the first one is considered safer as you can use ...


16

Was prompted by conversation with @Iszi on chat to make things much clearer - to just highlight the main increased risks. An attacker could reroute every request sent by users of the network leading to: Phishing attack - for example the normal guidance for users is to never click on untrusted links for things like online banking, but to always type in the ...


16

The first and main thing is to ensure that the firewall on your host is configured to properly drop incoming packets with source or destination address set to 127.0.0.1. Under normal circumstances, there should be no packet coming from the network and showing such addresses. However an attacker may attempt to forge such packets in order to reach your local ...


14

The other answers are correct, however there is one big fish being mostly ignored: DNS cache poisoning As @Larry said, since you own the router you own the DNS. Meaning you can cause any other user of that network, use any server you want for any address they request. But more than that: You can make leave your DNS ownership in place, even ...


14

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port. UPnP has a variety of security ...


13

No, because knowledge of the method is not enough to break it. You would also need to acquire information (e.g. Decryption keys), which simply cannot be obtained by an attacker. The attacker can't figure out the source IP, or look at the data. Each Tor node only "knows" the source and destination of a block of data that it is handling. It can't open it to ...


12

I'll take a crack at explaining this without technical jargon. Lets say you want to send a nasty letter to someone, but you'd rather not deliver the letter in person for fear that they might get angry with you. You can ask a courier to take the letter from your house, and deliver it to the recipient, right? That works, but has the problem that the courier ...


12

That seems to be a NetGear log entry, there are two possibilities for this: SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...


12

There is no risk here. The Internet is not just one protocol, but a series of protocols that stack up on top of each other. The exact definitions of each part of the stack differ somewhat from person to person, but the two we're concerned about here are fairly well-defined: the link layer and the network layer. Depending on who you ask, these layers have ...


11

If you own the router, you own the internet effectively. For example, you can tell the router to use your computer as the DNS server for all the clients on the network - that means you own address resolution for every client on the network.


9

The source addresses are not totally unknown: the first one is from canonical.com, which hosts Ubuntu packages (therefore I suppose that your system runs Ubuntu, and currently tries to see whether there are available updates for your installed packages). The second address is stackoverflow.com, a well-known site in these parts. Most probably, these packets ...


9

How should a DMZ be placed in a highly secure network architecture? The key is defense in depth between security domains. The extent of the deployed architecture will be dependant on the resources available, including financial limitations and technical capabilities. Defense in depth Defense in depth is an information assurance (IA) concept in which ...


9

Some configurations that come in my mind: Don't place the server in a DMZ Accept connections on 192.168.0.0 addresses in the Apache configuration. Place a deny from all + accept from with the correct range of IP in your apache configuration Deny forwarding of VPN connections (?) in your firewall (if applicable).


8

Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network. The side-effect of ...


8

There are absolutely no absolutes in security. From a training perspective - I'd say the first is more clear. It shows the concept that the outside world goes through these various layers and that it's easier to hit the DMZ and presumably what's stationed there is lower risk. It's also better from a layered defense point of view - as pointed out in other ...


8

Akamai Technologies, Inc. currently publishes it's IP ranges under these 14 ASNs (limiting the list to US based operations): AS36183, AS35994, AS35993, AS30675, AS23455, AS23454, AS22207, AS20189, AS18717, AS18680, AS17334, AS16702, AS16625, AS12222 The list of IP ranges goes into the thousands though (roughly 4000 of them), so I suggest you rather define ...


8

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so. Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid ...


8

Most manufacturer's firmwares for routers are actually built around the same open source software as open source alternative like dd-wrt. The real security distinction is not between a "manufacturer" and an "open source" firmwares; it is between a maintained firmware against one that is not. A crucial element for security is how promptly fixes for discovered ...


7

These terms are a bit more general that that, which may be the cause of the confusion. When Alice sends Bob a message over a packet switched network, like the Internet, then it is broken into a number of individual packets, which are sent one at a time. Each packet travels from router to router, eventually ending up at Bob's computer, where the message is ...


7

How to Break To answer your question about 'how to break' - the easiest way is to use a 'ping' program that uses other protocols and/or other options. hping3 is in Backtrack (you said you used Backtrack, but hping3 is available for download), and it allows you to use TCP and UDP pings, and it allows you to use other ICMP types for pings. TCP ping to port ...


7

The security measures which are the primary subject of your question here (MAC filtering, non-standard IP addressing) basically equate to "security through obscurity". They are very weak against a dedicated attacker, and so should not be relied upon as the only security functions in your system. That said, even security through obscurity has its place in a ...


7

If you've setup OpenVPN correctly, you've configured the client with a SSL CA that the server certificate should be signed with. If you've kept the CA's private key private, no other OpenVPN server will be able to present a certificate that your client will accept. Also, the other way around, you can configure your OpenVPN client to use an SSL certificate ...



Only top voted, non community-wiki answers of a minimum length are eligible