Hot answers tagged routing
13
The other answers are correct, however there is one big fish being mostly ignored:
DNS cache poisoning
As @Larry said, since you own the router you own the DNS. Meaning you can cause any other user of that network, use any server you want for any address they request.
But more than that:
You can make leave your DNS ownership in place, even ...
13
Was prompted by conversation with @Iszi on chat to make things much clearer - to just highlight the main increased risks.
An attacker could reroute every request sent by users of the network leading to:
Phishing attack - for example the normal guidance for users is to never click on untrusted links for things like online banking, but to always type in the ...
13
Absolutely. Given that you can modify the firmware on a router, you could infect it with a virus if you were so minded. DD WRT is Linux-based; some routing equipment uses OpenBSD or one of the other BSDs.
However, generally speaking, routers are fairly stripped down pieces of kit - i.e. they run very cut down versions of Linux, or OpenBSD - and as such, the ...
11
The two are functionally equivalent - the DMZ is effectively in a sandwich, as it has to have connections from the outside world firewalled, but also have firewalls restricting access from it to the internal network.
While the latter diagram is often what happens (for cost reasons - you need less firewalls) the first one is considered safer as you can use ...
9
Some configurations that come in my mind:
Don't place the server in a DMZ
Accept connections on 192.168.0.0 addresses in the Apache configuration.
Place a deny from all + accept from with the correct range of IP in your apache configuration
Deny forwarding of VPN connections (?) in your firewall (if applicable).
9
No, because knowledge of the method is not enough to break it. You would also need to acquire information (e.g. Decryption keys), which simply cannot be obtained by an attacker.
The attacker can't figure out the source IP, or look at the data. Each Tor node only "knows" the source and destination of a block of data that it is handling. It can't open it to ...
8
The source addresses are not totally unknown: the first one is from canonical.com, which hosts Ubuntu packages (therefore I suppose that your system runs Ubuntu, and currently tries to see whether there are available updates for your installed packages). The second address is stackoverflow.com, a well-known site in these parts. Most probably, these packets ...
8
That seems to be a NetGear log entry, there are two possibilities for this:
SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...
7
Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network.
The side-effect of ...
7
I'll take a crack at explaining this without technical jargon.
Lets say you want to send a nasty letter to someone, but you'd rather not deliver the letter in person for fear that they might get angry with you.
You can ask a courier to take the letter from your house, and deliver it to the recipient, right? That works, but has the problem that the courier ...
6
What you don't mention, and what is important generally for these kind of questions, is specifically what kind of hardware you have, what your requirements are (throughput, concurrent connections, cryptography load, etc.). What's a snapshot of your traffic look like, where's it coming from, and what, ideally, should be going in and out?
(And you've also ...
6
In the general case, it can be very difficult to differentiate packets with spoofed addresses. Most systems (servers or network devices) will only have a single NIC, so all traffic will come in on the same port. Static MAC entries can help mitigate collateral damage, but very quickly becomes a management nightmare. One of the few places you can detect and ...
6
If you've setup OpenVPN correctly, you've configured the client with a SSL CA that the server certificate should be signed with. If you've kept the CA's private key private, no other OpenVPN server will be able to present a certificate that your client will accept.
Also, the other way around, you can configure your OpenVPN client to use an SSL certificate ...
6
Please read the following previously asked questions:
How important is NAT as a security layer?
How can someone hack my PC if I am connecting to the internet through NAT?
What kind of attacks against home router's NAT do exist?
They answer all of your questions.
The short version is:
NAT does not automatically imply that all inbounded connections are ...
6
The security measures which are the primary subject of your question here (MAC filtering, non-standard IP addressing) basically equate to "security through obscurity". They are very weak against a dedicated attacker, and so should not be relied upon as the only security functions in your system.
That said, even security through obscurity has its place in a ...
5
Your web application, is much like any other service (file sharing, printing) that you've got running on your internal network.
Usually Internet routers will perform firewall functions, which block traffic from the Internet to any internal IP address, unless specifically told otherwise (via Static NAT or port forwarding), so direct access from the ...
5
Sounds like you are just looking for a bridging firewall.
http://www.cryptolife.org/index.php/Linux_Bridge_Firewall
Graphic below is from the link above:
http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge
"A bridge is a way to connect two Ethernet segments together in a protocol independent way. Packets are forwarded based on ...
5
Yes, routers can get infected. Typically they are just Linux boxen with a web server providing an admin interface, and a bunch of sockets and radios to provide networking. I've certainly had one before that, out of the box, had a weak default password and would listen on the public (DSL) interface for the admin server.
But do routers get infected? Yes. An ...
5
Under Solaris, the ip_strict_dst_multihoming parameter will perform the anti-IP spoofing function you're looking for. To quote, "by setting the parameter ip_strict_dst_multihoming to 0 the system drops any packets that appear to originate from a network attached to another interface "Solaris Kernel Tuning for Security". So to answer your question: risk can ...
5
There are lots of speculations, let's try it.
Assigning 127.0.0.1/8 to the network interface
On Debian it works as root to assign 127.0.0.1/8 to the network interface:
# ifconfig lo 10.0.0.1 netmask 255.0.0.0
# ifconfig eth0 127.0.0.2 netmask 255.0.0.0
and results in:
lo Link encap:Lokale Schleife
inet Adresse:10.0.0.1 ...
5
Universal considerations
It is common for most firewalls and NAT boxes to allow a server to reply back to the machine that sent a packet from the inside. Anything else is an edge case or insane behavior. Therefore, if a game client can initiate a connection to you, we can assume that you can talk back on that channel. The goal then is to keep the connection ...
5
Quite a lot of "enterprise" type access points offer functionality to allow multiple SSIDs on a single AP, and it's a pretty common configuration from what I've seen.
From a logical perspective the networks should be isolated (using VLANs or similar type of segregation). You should also be able to specify different authentication mechanisms, encryption ...
5
These terms are a bit more general that that, which may be the cause of the confusion.
When Alice sends Bob a message over a packet switched network, like the Internet, then it is broken into a number of individual packets, which are sent one at a time. Each packet travels from router to router, eventually ending up at Bob's computer, where the message is ...
5
Ping uses Internet Control Message Protocol, this also is used for other errors and stuff like preventing a packet ending up in an infinite loop around a group of routers. By blocking ICMP Echo Request packets or just not responding to them you can block a ping without blocking all other control codes.
Traceroute usually uses an echo request but sets the ...
5
How to Break
To answer your question about 'how to break' - the easiest way is to use a 'ping' program that uses other protocols and/or other options.
hping3 is in Backtrack (you said you used Backtrack, but hping3 is available for download), and it allows you to use TCP and UDP pings, and it allows you to use other ICMP types for pings.
TCP ping to port ...
5
How should a DMZ be placed in a highly secure network architecture?
The key is defense in depth between security domains. The extent of the deployed architecture will be dependant on the resources available, including financial limitations and technical capabilities.
Defense in depth
Defense in depth is an information assurance (IA) concept in which
...
5
It is not that the header has to be encrypted in tunnel mode; rather, if the header is not encrypted, it is not really a tunnel.
Tunnel mode is about having two routers linked together with an encrypted tunnel. They exchange packets for other hosts. Schematically, router A is the exit router for network netA, and router B is the exit router for network ...
4
Forensics comes down to how well trained and trustworthy the person doing the forensics is and is unrelated to the design of hardware.
If your router's software is compromised, there's no book of things that can be changed since anything the mind can conceive, can realistically be done. The processors on routers these days can run compilers, interpreters ...
4
Just to add to @Thomas' response. the packets you've got in that capture look to be responses to requests from your machine for a couple of reasons.
Ports. They've got source port 80 destination port [something in the high range] . that's a typical pattern for a connection to a webserver from your machine (thus likely that these packets are responses.
...
4
I've used VPN client software on Mac OS X that hijacks the default route to send all traffic through the tunnel (actually, if memory serves me correctly, that was Cisco's). If two such clients were installed, or even one and a sane client, then the answer to the question "where will this packet go?" will be timing and implementation dependent. Likely options ...
Only top voted, non community-wiki answers of a minimum length are eligible
