Tag Info

Hot answers tagged

42

This is not a security risk. The router looks in its ARP table to find the MAC address of your IP. The reason it can do this, is because you are connected to the router via layer 2 in the OSI model. The router simply looks up your IP in the arp cache to find its MAC address. A website on the internet is not connected to your LAN, and will not be able to ...


30

I tried to filter Google results for "message opened by mailclient" as follows: Jan 1, 2008 – Jan 1, 2009 Jan 1, 2009 – Jan 1, 2010 Jan 1, 2010 – Jan 1, 2011 Jan 1, 2011 – Jan 1, 2012 Jan 1, 2012 – Jan 1, 2013 Jan 1, 2013 – Oct 31, 2013 Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after ...


18

After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js. So, the message message opened by mailclient ...


10

There is no risk here. The Internet is not just one protocol, but a series of protocols that stack up on top of each other. The exact definitions of each part of the stack differ somewhat from person to person, but the two we're concerned about here are fairly well-defined: the link layer and the network layer. Depending on who you ask, these layers have ...


8

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so. Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid ...


4

Of your three questions, the answers would be: Yes Yes Yes So if these are a worry, you need to look at mitigation. What would help is to use https in every possible case - this at least hides passwords and content, but doesn't hide which websites you visit. Tor can help hide the websites you visit, so if that is a concern to you then yes, run ...


4

Yes, they can. Based on network topology, your protected network should be connected as far away from the Internet as possible. By allowing router Y to be directly connected to router X, all the wireless clients need to do would be to run a trace route, and then they will find out that they are actually connected to your corporate network. You can try to ...


4

Many routers can be flashed with custom firmware, e.g. DD-WRT, OpenWRT, or Tomato. These alternative systems have additional security features, for example: Enforcing SSL-only administration. Allowing HTTP(S) logins only internally, or only on wired connections. SSH login with client certificates. Stateful firewalls with more features than your average ...


4

After searching all day and digging through a few thousand more or less irrelevant posts in several user forums and a site which presumably "tests" for vulnerability (the telnet transcript however doesn't show anything but a somewhat broken HTML page), I found an actual exploit site. Turns out that as usual the publicly available information was deceptive. ...


3

Most manufacturer's firmwares for routers are actually built around the same open source software as open source alternative like dd-wrt. The real security distinction is not between a "manufacturer" and an "open source" firmwares; it is between a maintained firmware against one that is not. A crucial element for security is how promptly fixes for discovered ...


3

Many DSL modems are open from the WAN side for use by the telecompanies (you can try telneting from the wan side and see if it's open on your modem, try default username/passwors [1]), while it could have been the ISP that changed the DNS-servers it seems unlikely as the IPs are not in the same range. Like you said, the most likely intrusion vector is a ...


3

You can't detect if it's a wireless access point or not, what you can do is detect that a device was plugged in. With port security you can only allow your corporate devices to be plugged into the network whereas other detected apparatus will immediately cause the port to be shut down (white listing based on MAC address). Note that MAC spoofing is ...


3

From your description, I suppose that your router was configured such that: Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah". When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to ...


2

So you think that someone hacked into your router and upgraded the firmware internally on your network? I use a Netgear WNR3500lv2, with the custom firmware tomato you can even disable http access locally, you can also disable the SSH daemon it gives you lots of other fancy features such as bandwidth monitoring, web monitoring, vpn client/server and so on. ...


2

A basic router is both a network switch and another local system with an IP address. Things vary depending on how the router was configured, and how the network was configured, and what level of surveillance is applied. The "switch" part is nominally undetectable at the software level: a switch is a relay system, which does not have a MAC address, let alone ...


2

Absolutely. There are tools like Aircrack which are dedicated to cracking WEP and WPA-PSK keys. WEP keys can often be cracked in less than 10 minutes while WPA keys may take a few hours. Therefore, you should always choose WPA when setting up your router's security. Now, I suggest that you reset completely your router's settings to default and reconfigure ...


2

Did anyone perform a hard reset on the device? Usually there is a pin hole button you need to press for a few seconds to reset the device to the default configuration. Just a thought.


2

The node right next to the hidden service in that circuit does know its IP, but it knows nothing about it other than that; not even that it's a hidden service, nor the message that is being sent to it -- it looks just like another node in the circuit.


2

There are two fundamental facts to know about SSL/HTTPS: HTTPS is HTTP-within-SSL. In particular, URL don't exist at the SSL level. From the outside, without decrypting the contents, one can see that "this is SSL" and also that "this is for host www.example.com", but not "this is for URL https://www.example.com/foobar/index.html". The "foobar/index.html" ...


2

To add to what @Rory says, you might want to refine what you mean by "without modification". Technically, every single byte your computer sends and receives will go through the router, so whoever has full control on the router can potentially get a copy of it. Without any form of encryption, he will see everything, including names of Web sites and plaintext ...


2

DDoS can be analysed simply by checking the volume and pattern of traffic hitting the router. Any decent router will have something called SNMP (Simple Network Management Protocol). SNMP captures information about the performance of the router (in this case, it can be used for all manner of devices) and allows an external service to take the data, aggregate ...


2

That's a truncated hostname, and it's actually in reverse IP order. The full hostname is 182.53.252.66.knds.xdsl.dyn.ottcommunications.com. OTT Communications seems to cover from Maine to West Virginia. Maybe they're your ISP, or your ISP resells for them? Does your IP match 66.252.53.182?


1

Most likely they are using Deep Packet Inspection. There is a tool called stunnel that allows you to encapsulate any protocol over SSL/TLS. I would have to warn you against using this to bypass your schools filters though, as you would likely be breaking policy or contract which could result in legal or academic punishment. It is cool tech so I think it ...


1

The anti-spoofing mechanism of your firewall appears to be blocking the traffic, which means that it's doing what it's supposed to do. Devices exposed to the internet are routinely checked for easy exploits, port scanned, etc. I would say that my client networks are scanned at least once a day, and we mitigate the risk by ensuring the proper defense ...


1

I think that you have the answer to your question in the firewall rules. From your network diagram it's reasonable to expect that your ISP has access to the Wi-Fi bridge that they provide, so if a host is accessible from there, it's likely he can access it. In your rules, as you mention rule 60 seems out of place. Rule 61 looks like a standard rule ...


1

You would look for a network setup that includes a "DMZ" (demilitarized zone) or service network. This network is accessible from the external network (i.e the Internet), but it cannot "jump" to your secured, internal network. Basically, your internal network can access the Internet and your DMZ server. The Internet can only reach your DMZ server. (Not ...


1

You are talking about the difference between a transparent socket proxy and a non-transparent protocol proxy. As domain names (that SSL checks) operate at a different level than IPs (that transparent sockets proxy use), you can proxy an entire host (for a given port). But as Thomas mentions, you can not proxy a specific URL subset as this wrapped within the ...


1

Well, for knowing if a dd-wrt firmware router is more secure than its original firmware, proper security measurement tests should be done, and I believe that nobody has done those tests, so I am going to throw some thoughts: We should first consider which brand, because some of them already have dd-wrt like in their systems, like Fon, and others like ...


1

Even if you could, disabling ping requests would do nothing... for real, it's just for testing purposes. Apparently you're being somehow DDose'd... i would suggest reading here. The only 100% effective recommendation is for you (if you don't have a static IP) reset your router and check if the IP changed, (it should if you have a dynamic IP.) if yes, ...


1

It's for DNS. I'm going to go out on a limb and suggest you probably want to leave it that way. http://www.networkworld.com/community/blog/allow-both-tcp-and-udp-port-53-your-dns-serve



Only top voted, non community-wiki answers of a minimum length are eligible