Tag Info

Hot answers tagged

42

This is not a security risk. The router looks in its ARP table to find the MAC address of your IP address. The reason it can do this, is because you are connected to the router via layer 2 in the OSI model. The router simply looks up your IP address in the ARP cache to find its MAC address. A website on the Internet is not connected to your LAN and will not ...


10

There is no risk here. The Internet is not just one protocol, but a series of protocols that stack up on top of each other. The exact definitions of each part of the stack differ somewhat from person to person, but the two we're concerned about here are fairly well-defined: the link layer and the network layer. Depending on who you ask, these layers have ...


6

I must disagree with @vahid. If there are multiple hops between the NAT and the host to which the connection is being port-forwarded, you may actually be able to elicit an ICMP TIMEX message. As you may know, every IPv4 packet has a 1 byte TTL field. If you determine the distance to the NAT (say 10 hops) and the actual concealed host is actually 12 hops ...


6

Most manufacturer's firmwares for routers are actually built around the same open source software as open source alternative like dd-wrt. The real security distinction is not between a "manufacturer" and an "open source" firmwares; it is between a maintained firmware against one that is not. A crucial element for security is how promptly fixes for discovered ...


4

After searching all day and digging through a few thousand more or less irrelevant posts in several user forums and a site which presumably "tests" for vulnerability (the telnet transcript however doesn't show anything but a somewhat broken HTML page), I found an actual exploit site. Turns out that as usual the publicly available information was deceptive. ...


2

DDoS can be analysed simply by checking the volume and pattern of traffic hitting the router. Any decent router will have something called SNMP (Simple Network Management Protocol). SNMP captures information about the performance of the router (in this case, it can be used for all manner of devices) and allows an external service to take the data, aggregate ...


2

That's a truncated hostname, and it's actually in reverse IP order. The full hostname is 182.53.252.66.knds.xdsl.dyn.ottcommunications.com. OTT Communications seems to cover from Maine to West Virginia. Maybe they're your ISP, or your ISP resells for them? Does your IP match 66.252.53.182?


2

What you are trying to achieve is not possible, by design. The only way of achieving this is by having access to either the gateway or the host machine. A NAT device serves the dual purpose of sharing an internet connection with an internal network and protecting the internal network much like a traditional firewall would. [edit] I stand corrected. The IETF ...


2

Since access has been sufficiently restricted, the weakest link is the HTTP request. This is especially true based on comments regarding the poor interfaces of the IP cameras. They likely won't do well if irregular requests are sent. Therefore consider a Web Application Firewall (WAF) such as ModSecurity as it will provide more flexibility over what ...


1

Tor is best known for providing anonymity to the users communication. Every time tor uses different routes to forward the data to destination to maintain anonymity. If it is not doing so then same path can be traced to intercept the communication. I think this is the best method to anonymize the communication.


1

You are unable to see the rest of the network now because you have connected a router between and you are now basically on a 'separate' network --- check the IP addresses --- if they are not all in the same CLASS then you are on different networks and cannot see everything, although, technically everything is connected together. Secondly, a mac address is ...


1

Yes, your ISP is very clearly hijacking not only the DNS for google, but also DNS requests you try to send to outside DNS servers. You are correct in your analysis that the traffic to Google is not leaving your ISPs network. Your traceroutes also show that your DNS queries to Google Public DNS, as well as to Level 3's open resolvers, are not leaving your ...


1

It depends on the original firmware you are replacing, however it could be more secure than many "consumer" router firmwares because it does not support WPS at all (which is a known security risk)


1

Most enterprise-sized routers/firewalls include Intrusion Detection (or Prevention) Systems (IDS or IPS) which can notice and block certain kinds of network attacks. Most of these devices also regularly download new attack pattern definitions from the manufacturer, much like your PC's antivirus does. Some manufacturers also offer a service where they'll ...


1

If you use a recent enough browser (mostly not ie on windows xp), it will likely have SNI support to allow virtual hosting of HTTPS sites. This means that it will send the domain name unencrypted to allow the server to choose the correct certificate. Depending on what you use to filter traffic, you could thus block HTTP and HTTPS traffic to a specific ...


1

You can block by IP and by domain name. If the domain uses different IP addresses, and you block only one IP, the site will keep working with the other IP addresses. If you block the domain, and the site works by opening the IP address in the browser, it will keep working as well. You can block domain names and IP addresses by port number. So you can block ...


1

Most likely they are using Deep Packet Inspection. There is a tool called stunnel that allows you to encapsulate any protocol over SSL/TLS. I would have to warn you against using this to bypass your schools filters though, as you would likely be breaking policy or contract which could result in legal or academic punishment. It is cool tech so I think it ...


1

The anti-spoofing mechanism of your firewall appears to be blocking the traffic, which means that it's doing what it's supposed to do. Devices exposed to the internet are routinely checked for easy exploits, port scanned, etc. I would say that my client networks are scanned at least once a day, and we mitigate the risk by ensuring the proper defense ...


1

I think that you have the answer to your question in the firewall rules. From your network diagram it's reasonable to expect that your ISP has access to the Wi-Fi bridge that they provide, so if a host is accessible from there, it's likely he can access it. In your rules, as you mention rule 60 seems out of place. Rule 61 looks like a standard rule ...


1

Proxying as you propose doing gives you the ability to add additional authentication and encryption, but nothing else. IP cameras have terrible interfaces and terrible code. If you simply proxy the requests you will be proxying every possible exploit in the camera. If authenticated user sessions are considered a potential attack vector in your risk ...


1

You would look for a network setup that includes a "DMZ" (demilitarized zone) or service network. This network is accessible from the external network (i.e the Internet), but it cannot "jump" to your secured, internal network. Basically, your internal network can access the Internet and your DMZ server. The Internet can only reach your DMZ server. (Not ...


1

Well, for knowing if a dd-wrt firmware router is more secure than its original firmware, proper security measurement tests should be done, and I believe that nobody has done those tests, so I am going to throw some thoughts: We should first consider which brand, because some of them already have dd-wrt like in their systems, like Fon, and others like ...


1

Even if you could, disabling ping requests would do nothing... for real, it's just for testing purposes. Apparently you're being somehow DDose'd... i would suggest reading here. The only 100% effective recommendation is for you (if you don't have a static IP) reset your router and check if the IP changed, (it should if you have a dynamic IP.) if yes, ...


1

It's for DNS. I'm going to go out on a limb and suggest you probably want to leave it that way. http://www.networkworld.com/community/blog/allow-both-tcp-and-udp-port-53-your-dns-serve


1

Reverse path filtering (or forwarding) has nothing to do with an application. Applications have no knowledge of the underlying network topology, RPF is done at a lower level. Most attacks that take advantage of systems that do not check their routing information base before forwarding packets are denial of service attacks, or reflection attacks. Here's how ...



Only top voted, non community-wiki answers of a minimum length are eligible