Tag Info

Hot answers tagged

42

This is not a security risk. The router looks in its ARP table to find the MAC address of your IP address. The reason it can do this, is because you are connected to the router via layer 2 in the OSI model. The router simply looks up your IP address in the ARP cache to find its MAC address. A website on the Internet is not connected to your LAN and will not ...


35

MAC filtering is not a part of the 802.11 spec, and is instead shoved into wireless routers by (most) vendors. The reason why it's not a part of the 802.11 spec is because it provides no true security (via kerckhoff's principle). In order for wireless to work, MAC addresses are exchanged in plaintext (Regardless of whether you're using WEP, WPA, WPA2, or ...


30

I tried to filter Google results for "message opened by mailclient" as follows: Jan 1, 2008 – Jan 1, 2009 Jan 1, 2009 – Jan 1, 2010 Jan 1, 2010 – Jan 1, 2011 Jan 1, 2011 – Jan 1, 2012 Jan 1, 2012 – Jan 1, 2013 Jan 1, 2013 – Oct 31, 2013 Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after ...


18

After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js. So, the message message opened by mailclient ...


16

The two are functionally equivalent - the DMZ is effectively in a sandwich, as it has to have connections from the outside world firewalled, but also have firewalls restricting access from it to the internal network. While the latter diagram is often what happens (for cost reasons - you need less firewalls) the first one is considered safer as you can use ...


16

Was prompted by conversation with @Iszi on chat to make things much clearer - to just highlight the main increased risks. An attacker could reroute every request sent by users of the network leading to: Phishing attack - for example the normal guidance for users is to never click on untrusted links for things like online banking, but to always type in the ...


14

The other answers are correct, however there is one big fish being mostly ignored: DNS cache poisoning As @Larry said, since you own the router you own the DNS. Meaning you can cause any other user of that network, use any server you want for any address they request. But more than that: You can make leave your DNS ownership in place, even ...


14

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


13

No, because knowledge of the method is not enough to break it. You would also need to acquire information (e.g. Decryption keys), which simply cannot be obtained by an attacker. The attacker can't figure out the source IP, or look at the data. Each Tor node only "knows" the source and destination of a block of data that it is handling. It can't open it to ...


12

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port. UPnP has a variety of security ...


11

If you own the router, you own the internet effectively. For example, you can tell the router to use your computer as the DNS server for all the clients on the network - that means you own address resolution for every client on the network.


11

I'll take a crack at explaining this without technical jargon. Lets say you want to send a nasty letter to someone, but you'd rather not deliver the letter in person for fear that they might get angry with you. You can ask a courier to take the letter from your house, and deliver it to the recipient, right? That works, but has the problem that the courier ...


11

That seems to be a NetGear log entry, there are two possibilities for this: SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...


10

There is no risk here. The Internet is not just one protocol, but a series of protocols that stack up on top of each other. The exact definitions of each part of the stack differ somewhat from person to person, but the two we're concerned about here are fairly well-defined: the link layer and the network layer. Depending on who you ask, these layers have ...


9

The source addresses are not totally unknown: the first one is from canonical.com, which hosts Ubuntu packages (therefore I suppose that your system runs Ubuntu, and currently tries to see whether there are available updates for your installed packages). The second address is stackoverflow.com, a well-known site in these parts. Most probably, these packets ...


9

Some configurations that come in my mind: Don't place the server in a DMZ Accept connections on 192.168.0.0 addresses in the Apache configuration. Place a deny from all + accept from with the correct range of IP in your apache configuration Deny forwarding of VPN connections (?) in your firewall (if applicable).


8

Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network. The side-effect of ...


8

How should a DMZ be placed in a highly secure network architecture? The key is defense in depth between security domains. The extent of the deployed architecture will be dependant on the resources available, including financial limitations and technical capabilities. Defense in depth Defense in depth is an information assurance (IA) concept in which ...


8

There are absolutely no absolutes in security. From a training perspective - I'd say the first is more clear. It shows the concept that the outside world goes through these various layers and that it's easier to hit the DMZ and presumably what's stationed there is lower risk. It's also better from a layered defense point of view - as pointed out in other ...


8

Akamai Technologies, Inc. currently publishes it's IP ranges under these 14 ASNs (limiting the list to US based operations): AS36183, AS35994, AS35993, AS30675, AS23455, AS23454, AS22207, AS20189, AS18717, AS18680, AS17334, AS16702, AS16625, AS12222 The list of IP ranges goes into the thousands though (roughly 4000 of them), so I suggest you rather define ...


8

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so. Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid ...


7

How to Break To answer your question about 'how to break' - the easiest way is to use a 'ping' program that uses other protocols and/or other options. hping3 is in Backtrack (you said you used Backtrack, but hping3 is available for download), and it allows you to use TCP and UDP pings, and it allows you to use other ICMP types for pings. TCP ping to port ...


7

If you've setup OpenVPN correctly, you've configured the client with a SSL CA that the server certificate should be signed with. If you've kept the CA's private key private, no other OpenVPN server will be able to present a certificate that your client will accept. Also, the other way around, you can configure your OpenVPN client to use an SSL certificate ...


7

Since you found my comment helpful, I'll just write it as an answer. The concept is pretty simple. You bind your webserver to your localhost only, so it won't accept connections from outside your computer. Then you configure Tor to connect to this server. Since Tor is installed in your computer, it will be able to connect to your webserver, but others ...


7

Why are you using iptables rather than using good old Wireshark which is specifically made for this? Wireshark is a free and open-source packet analyzer and the ideal tool for performing these types of analysis. EDIT If you need to reinject the packets I would have a look at scapy in python.


7

Most likely Universal Plug and Play is activated in your router which allows devices to ask for forwarded ports without the need for further router configuration. Obviously this also implies some security risks.


6

In the general case, it can be very difficult to differentiate packets with spoofed addresses. Most systems (servers or network devices) will only have a single NIC, so all traffic will come in on the same port. Static MAC entries can help mitigate collateral damage, but very quickly becomes a management nightmare. One of the few places you can detect and ...


6

There are lots of speculations, let's try it. Assigning 127.0.0.1/8 to the network interface On Debian it works as root to assign 127.0.0.1/8 to the network interface: # ifconfig lo 10.0.0.1 netmask 255.0.0.0 # ifconfig eth0 127.0.0.2 netmask 255.0.0.0 and results in: lo Link encap:Lokale Schleife inet Adresse:10.0.0.1 ...



Only top voted, non community-wiki answers of a minimum length are eligible