Tag Info

Hot answers tagged

34

MAC filtering is not a part of the 802.11 spec, and is instead shoved into wireless routers by (most) vendors. The reason why it's not a part of the 802.11 spec is because it provides no true security (via kerckhoff's principle). In order for wireless to work, MAC addresses are exchanged in plaintext (Regardless of whether you're using WEP, WPA, WPA2, or ...


30

I tried to filter Google results for "message opened by mailclient" as follows: Jan 1, 2008 – Jan 1, 2009 Jan 1, 2009 – Jan 1, 2010 Jan 1, 2010 – Jan 1, 2011 Jan 1, 2011 – Jan 1, 2012 Jan 1, 2012 – Jan 1, 2013 Jan 1, 2013 – Oct 31, 2013 Looking into the results, you'll find something interesting. The more you go back in time, the lower the number after ...


18

After registering for Mail.com (where the MP send her mail from), and looking to the source code of the web interface, "6.73.3.0" (the IP adress of the military base) is coincedently the version number of their webinterface-software. Cf. the suffix of this Javascript-file directory-lookup-table-6.73.3.0.js. So, the message message opened by mailclient ...


10

That seems to be a NetGear log entry, there are two possibilities for this: SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...


10

All the tracerouting tools rely on the following principle: they send packets with a short life, and wait for ICMP packets reporting the death of these packets. An IP packet has a field called "TTL" (as "Time To Live") which is decremented at each hop; when it reaches 0, the packet dies, and the router on which this happens is supposed to send back a "Time ...


9

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port. UPnP has a variety of security ...


8

Emails sent in the clear can be "read" by any mail server it passes through during transit - it would not be necessary to add that header line to do so. Also, email headers are entirely arbitrary - I could make my mail server add a "Delivered by pigeon" header line if I wanted to do so. Therefore, I was in a position to snoop on emails, it would be stupid ...


7

Akamai Technologies, Inc. currently publishes it's IP ranges under these 14 ASNs (limiting the list to US based operations): AS36183, AS35994, AS35993, AS30675, AS23455, AS23454, AS22207, AS20189, AS18717, AS18680, AS17334, AS16702, AS16625, AS12222 The list of IP ranges goes into the thousands though (roughly 4000 of them), so I suggest you rather define ...


7

Why are you using iptables rather than using good old Wireshark which is specifically made for this? Wireshark is a free and open-source packet analyzer and the ideal tool for performing these types of analysis. EDIT If you need to reinject the packets I would have a look at scapy in python.


7

Since you found my comment helpful, I'll just write it as an answer. The concept is pretty simple. You bind your webserver to your localhost only, so it won't accept connections from outside your computer. Then you configure Tor to connect to this server. Since Tor is installed in your computer, it will be able to connect to your webserver, but others ...


6

While there are some IDS/IPS devices which are marketed as 'minimal' setup, in reality IDS is one of the most setup-intensive devices in a typical network. In your situation, I would strongly suggest that you avoid this type of device as there is a high likelihood that false positives would further convince your client that he is being targeted. I would ...


5

It is not that the header has to be encrypted in tunnel mode; rather, if the header is not encrypted, it is not really a tunnel. Tunnel mode is about having two routers linked together with an encrypted tunnel. They exchange packets for other hosts. Schematically, router A is the exit router for network netA, and router B is the exit router for network ...


5

First, it does nothing to protect data on the network. Second, MAC addresses can be easily spoofed and a valid MAC address can be sniffed off of any device connected to your network. It will only keep out the most basic of intruders (ie, someone who is non-technical and simply looking for free wifi.) It offers no serious protection to simply use MAC ...


4

Both traceroute and tcptraceroute work on the same basic principle: Send a packet out with a really low TTL See who sends back an ICMP TTL exceeded at TTL expiration If send-backer is destination, stop Otherwise, increment the TTL by 1 and go back to step #1 The only difference is what type of packet is sent out (default is UDP on Linux, ICMP on Windows, ...


4

Of your three questions, the answers would be: Yes Yes Yes So if these are a worry, you need to look at mitigation. What would help is to use https in every possible case - this at least hides passwords and content, but doesn't hide which websites you visit. Tor can help hide the websites you visit, so if that is a concern to you then yes, run ...


4

Many routers can be flashed with custom firmware, e.g. DD-WRT, OpenWRT, or Tomato. These alternative systems have additional security features, for example: Enforcing SSL-only administration. Allowing HTTP(S) logins only internally, or only on wired connections. SSH login with client certificates. Stateful firewalls with more features than your average ...


4

Yes, they can. Based on network topology, your protected network should be connected as far away from the Internet as possible. By allowing router Y to be directly connected to router X, all the wireless clients need to do would be to run a trace route, and then they will find out that they are actually connected to your corporate network. You can try to ...


4

After searching all day and digging through a few thousand more or less irrelevant posts in several user forums and a site which presumably "tests" for vulnerability (the telnet transcript however doesn't show anything but a somewhat broken HTML page), I found an actual exploit site. Turns out that as usual the publicly available information was deceptive. ...


3

You can't detect if it's a wireless access point or not, what you can do is detect that a device was plugged in. With port security you can only allow your corporate devices to be plugged into the network whereas other detected apparatus will immediately cause the port to be shut down (white listing based on MAC address). Note that MAC spoofing is ...


3

From your description, I suppose that your router was configured such that: Using the WiFi entailed knowing the WiFi password, set to the password "blahblahblahblahblah". When contacting the router over IP (whether from the WiFi, or from the outside -- a router, by definition, routes data, so it is connected to at least two networks), it is possible to ...


3

Let's get to the root of the problem(s): Someone is accessing his network remotely, and its likely all his passwords are compromised. If someone does have a hook into his network, no matter what he types, there is a high likelihood that his password is being either written (stored) or watched (keystroke logger). 1) Someone is accessing his network remotely. ...


3

Many DSL modems are open from the WAN side for use by the telecompanies (you can try telneting from the wan side and see if it's open on your modem, try default username/passwors [1]), while it could have been the ISP that changed the DNS-servers it seems unlikely as the IPs are not in the same range. Like you said, the most likely intrusion vector is a ...


3

Most manufacturer's firmwares for routers are actually built around the same open source software as open source alternative like dd-wrt. The real security distinction is not between a "manufacturer" and an "open source" firmwares; it is between a maintained firmware against one that is not. A crucial element for security is how promptly fixes for discovered ...


2

Even a WEP/WPA password of 'password' is better than no password because then the traffic is encrypted. If you have no password then your traffic, aside from SSL protected sites, is right in the open. Your MAC address can be changed at will, and as mentioned by Steel City Hacker, can be sniffed right out of the open. I recommend you explore your ...


2

When used in tunnel mode IPsec treats the IP packet as a payload. Therefore, all this information is encrypted. In order to be routed correctly, the IPSec-enabled entity then build a new packet. This IP packet is built to be send to the tunnel end, e.g. another IPSec gateway. So as to achieve this, the new IP packet will have a brand new IP-Header, with ...


2

A basic router is both a network switch and another local system with an IP address. Things vary depending on how the router was configured, and how the network was configured, and what level of surveillance is applied. The "switch" part is nominally undetectable at the software level: a switch is a relay system, which does not have a MAC address, let alone ...


2

So you think that someone hacked into your router and upgraded the firmware internally on your network? I use a Netgear WNR3500lv2, with the custom firmware tomato you can even disable http access locally, you can also disable the SSH daemon it gives you lots of other fancy features such as bandwidth monitoring, web monitoring, vpn client/server and so on. ...


2

How is the syn flag in TCP used to achieve traceroute like functionality (when ICMP is off) Any IP packet will trigger an ICMP "Time Exceeded" response from an intermediate router when the TTL value reaches zero. This could be TCP, UDP, ICMP, or any other. As long as intervening routers will pass the packet, the trace will work. Traditional ...


2

Absolutely. There are tools like Aircrack which are dedicated to cracking WEP and WPA-PSK keys. WEP keys can often be cracked in less than 10 minutes while WPA keys may take a few hours. Therefore, you should always choose WPA when setting up your router's security. Now, I suggest that you reset completely your router's settings to default and reconfigure ...


2

There are two fundamental facts to know about SSL/HTTPS: HTTPS is HTTP-within-SSL. In particular, URL don't exist at the SSL level. From the outside, without decrypting the contents, one can see that "this is SSL" and also that "this is for host www.example.com", but not "this is for URL https://www.example.com/foobar/index.html". The "foobar/index.html" ...



Only top voted, non community-wiki answers of a minimum length are eligible