Tag Info

Hot answers tagged

34

MAC filtering is not a part of the 802.11 spec, and is instead shoved into wireless routers by (most) vendors. The reason why it's not a part of the 802.11 spec is because it provides no true security (via kerckhoff's principle). In order for wireless to work, MAC addresses are exchanged in plaintext (Regardless of whether you're using WEP, WPA, WPA2, or ...


30

I tried to filter Google results for "message opened by mailclient" as follows: Jan 1, 2008 – Jan 1, 2009 Jan 1, 2009 – Jan 1, 2010 Jan 1, 2010 – Jan 1, 2011 Jan 1, 2011 – Jan 1, 2012 Jan 1, 2012 – Jan 1, 2013 Jan 1, 2013 – Oct 31, 2013 Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after ...


18

After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js. So, the message message opened by mailclient ...


15

The two are functionally equivalent - the DMZ is effectively in a sandwich, as it has to have connections from the outside world firewalled, but also have firewalls restricting access from it to the internal network. While the latter diagram is often what happens (for cost reasons - you need less firewalls) the first one is considered safer as you can use ...


14

The other answers are correct, however there is one big fish being mostly ignored: DNS cache poisoning As @Larry said, since you own the router you own the DNS. Meaning you can cause any other user of that network, use any server you want for any address they request. But more than that: You can make leave your DNS ownership in place, even ...


14

Was prompted by conversation with @Iszi on chat to make things much clearer - to just highlight the main increased risks. An attacker could reroute every request sent by users of the network leading to: Phishing attack - for example the normal guidance for users is to never click on untrusted links for things like online banking, but to always type in the ...


11

No, because knowledge of the method is not enough to break it. You would also need to acquire information (e.g. Decryption keys), which simply cannot be obtained by an attacker. The attacker can't figure out the source IP, or look at the data. Each Tor node only "knows" the source and destination of a block of data that it is handling. It can't open it to ...


10

I'll take a crack at explaining this without technical jargon. Lets say you want to send a nasty letter to someone, but you'd rather not deliver the letter in person for fear that they might get angry with you. You can ask a courier to take the letter from your house, and deliver it to the recipient, right? That works, but has the problem that the courier ...


10

That seems to be a NetGear log entry, there are two possibilities for this: SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...


10

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


9

Some configurations that come in my mind: Don't place the server in a DMZ Accept connections on 192.168.0.0 addresses in the Apache configuration. Place a deny from all + accept from with the correct range of IP in your apache configuration Deny forwarding of VPN connections (?) in your firewall (if applicable).


9

The source addresses are not totally unknown: the first one is from canonical.com, which hosts Ubuntu packages (therefore I suppose that your system runs Ubuntu, and currently tries to see whether there are available updates for your installed packages). The second address is stackoverflow.com, a well-known site in these parts. Most probably, these packets ...


9

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port. UPnP has a variety of security ...


8

Switches are not meant for security. A switch differs from a hub in that it observes packets to deduce where each host is, so that a packet aimed at a given host will be written only on the physical cable leading to that host. This is a performance optimization in that it allows more traffic to happen concurrently on a given network. The side-effect of ...


8

There are absolutely no absolutes in security. From a training perspective - I'd say the first is more clear. It shows the concept that the outside world goes through these various layers and that it's easier to hit the DMZ and presumably what's stationed there is lower risk. It's also better from a layered defense point of view - as pointed out in other ...


8

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so. Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid ...


7

If you've setup OpenVPN correctly, you've configured the client with a SSL CA that the server certificate should be signed with. If you've kept the CA's private key private, no other OpenVPN server will be able to present a certificate that your client will accept. Also, the other way around, you can configure your OpenVPN client to use an SSL certificate ...


7

Since you found my comment helpful, I'll just write it as an answer. The concept is pretty simple. You bind your webserver to your localhost only, so it won't accept connections from outside your computer. Then you configure Tor to connect to this server. Since Tor is installed in your computer, it will be able to connect to your webserver, but others ...


7

Why are you using iptables rather than using good old Wireshark which is specifically made for this? Wireshark is a free and open-source packet analyzer and the ideal tool for performing these types of analysis. EDIT If you need to reinject the packets I would have a look at scapy in python.


7

Akamai Technologies, Inc. currently publishes it's IP ranges under these 14 ASNs (limiting the list to US based operations): AS36183, AS35994, AS35993, AS30675, AS23455, AS23454, AS22207, AS20189, AS18717, AS18680, AS17334, AS16702, AS16625, AS12222 The list of IP ranges goes into the thousands though (roughly 4000 of them), so I suggest you rather define ...


6

What you don't mention, and what is important generally for these kind of questions, is specifically what kind of hardware you have, what your requirements are (throughput, concurrent connections, cryptography load, etc.). What's a snapshot of your traffic look like, where's it coming from, and what, ideally, should be going in and out? (And you've also ...


6

In the general case, it can be very difficult to differentiate packets with spoofed addresses. Most systems (servers or network devices) will only have a single NIC, so all traffic will come in on the same port. Static MAC entries can help mitigate collateral damage, but very quickly becomes a management nightmare. One of the few places you can detect and ...


6

There are lots of speculations, let's try it. Assigning 127.0.0.1/8 to the network interface On Debian it works as root to assign 127.0.0.1/8 to the network interface: # ifconfig lo 10.0.0.1 netmask 255.0.0.0 # ifconfig eth0 127.0.0.2 netmask 255.0.0.0 and results in: lo Link encap:Lokale Schleife inet Adresse:10.0.0.1 ...


6

Please read the following previously asked questions: How important is NAT as a security layer? How can someone hack my PC if I am connecting to the internet through NAT? What kind of attacks against home router's NAT do exist? They answer all of your questions. The short version is: NAT does not automatically imply that all inbounded connections are ...


6

These terms are a bit more general that that, which may be the cause of the confusion. When Alice sends Bob a message over a packet switched network, like the Internet, then it is broken into a number of individual packets, which are sent one at a time. Each packet travels from router to router, eventually ending up at Bob's computer, where the message is ...


6

How to Break To answer your question about 'how to break' - the easiest way is to use a 'ping' program that uses other protocols and/or other options. hping3 is in Backtrack (you said you used Backtrack, but hping3 is available for download), and it allows you to use TCP and UDP pings, and it allows you to use other ICMP types for pings. TCP ping to port ...


6

The security measures which are the primary subject of your question here (MAC filtering, non-standard IP addressing) basically equate to "security through obscurity". They are very weak against a dedicated attacker, and so should not be relied upon as the only security functions in your system. That said, even security through obscurity has its place in a ...


6

While there are some IDS/IPS devices which are marketed as 'minimal' setup, in reality IDS is one of the most setup-intensive devices in a typical network. In your situation, I would strongly suggest that you avoid this type of device as there is a high likelihood that false positives would further convince your client that he is being targeted. I would ...


5

Under Solaris, the ip_strict_dst_multihoming parameter will perform the anti-IP spoofing function you're looking for. To quote, "by setting the parameter ip_strict_dst_multihoming to 0 the system drops any packets that appear to originate from a network attached to another interface "Solaris Kernel Tuning for Security". So to answer your question: risk can ...



Only top voted, non community-wiki answers of a minimum length are eligible