Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

Filter by
Sorted by
Tagged with
2
votes
1answer
104 views

What is the risk of having an old, Internet capable phone not used for Interned compromised? (not smartphone)

I'm talking about a class of old mobile phones that are not smartphones but are still (theoretically) Internet-capable, at least via 3G. Examples of such phones include Series 40 Nokia phones or the ...
0
votes
1answer
36 views

What happens when attacker scan a IP that is used by multiple devices? [duplicate]

Assuming ISP gives only 1 external IP and you have few devices that use this IP. So you will have a router and few PC's with same external IP and different local IP. When all PC's are online and one ...
0
votes
0answers
6 views

How to block entire subnets except their gateways with iptables? [migrated]

Using iptables, how do I drop an entire subnet that I am connected to, except for the gateway, in a manner that still allows me to retain my connectivity to it? I'm looking for two iptables rules, one ...
0
votes
2answers
99 views

Is a LAN to LAN with different subnet configuration secure?

I plan to implement the following network configuration : Internet [(cable A)] Router A (192.168.0.x)[(WAN:cable A)(LAN1:cable B)(LAN2:)(LAN3:)(LAN4:)] Router B (192.168.1.x)[(WAN:)(LAN1:cable B)(LAN2:...
15
votes
3answers
44k views

Nmap says host down when host is up

I am using Nmap 7.12 on Mac OS X. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP replies and vice versa. I am scanning an IP inside the ...
1
vote
1answer
90 views

Find Ripple20 using nmap or wireshark

Everyone might have heard about Ripple20 vulnerability which has impacted millions of IoT devices. I know that using Nessus or Qualys, it is possible to identify this vulnerability. Is it possible to ...
0
votes
0answers
37 views

Should Group Key Update Interval be Off or On?

My router has this option and I was wondering if it should be turned off or on for better security? If it is better security to leave it on what is the best interval for maximum security?
214
votes
8answers
195k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
0
votes
0answers
20 views

Which authentication procedure is better for in IoT enabled environment? [closed]

i'm studying authentication methods for IoT environment and i would like to know which authentication protocol do you think is the most recommended in this environment between one-way, two-way (mutual)...
2
votes
1answer
26 views

CSRF: GET request with POST data?

I have stumbled upon a vulnerability in a web application and was wondering if it was exploitable / worth reporting. The bug is a CSRF which would allow an attacker to send friend requests to himself ...
35
votes
5answers
16k views

What is the use case for using TLS on an internal network?

If there are admin consoles on the internal network and TLS has been disabled what is the use case for enabling it? The only use case I can think of is when you have untrusted users on the network ...
0
votes
2answers
81 views

How do I write my own authentication protocol and add that to OpenWrt? [closed]

I would like to add a ticket based authentication mechanism to my network. Can you give me brief idea where do I start, which language should i write the protocol in and how do i get those in my ...
-1
votes
0answers
25 views

Attacks on EAP-AKA' protocol (5g) [closed]

I'm doing research on authentication protocols and I'm analyzing the EAP-AKA' protocol described in RFC 5448 that is one of the three protocols adopted in 5G. I would like to know if there are any ...
4
votes
2answers
84 views

Are there security reasons for prohibiting universal mac address modification?

Background In a standard 48-bit MAC address, the 7th (most significant) bit specifies whether it is a universally-administered address (UAA) or a locally-administered address (LAA). If it is 0, then ...
0
votes
0answers
58 views

What is the ISP Log retention timeline? [closed]

How do ISP store IP logs in timeline terms? Suppose an ISP stores logs for 6 months, do they store the january-december (yearly) logs for 6 months, or do they rotate them so each month is only stored ...
1
vote
1answer
979 views

Using xarp on a network

I am slightly worried about getting into trouble... I have installed Xarp and when I opened it, it started listing IPs. I am on a public network, so would it get flagged on the administrator's side??
0
votes
2answers
74 views

Assigning static IP address other than 127.0.0.0/8 to loopback interface

We have the following configuration of the /etc/network/interfaces file which was setup by somebody else on this system. It has worked well by allowing other systems on LAN (and the internet) to ...
3
votes
2answers
2k views

Is Chromecast's UPnP requirement “a security nightmare”?

I'd like to use Chromecast on our office network. Doing so requires enabling UPnP (Universal Plug and Play). A quick search turns up statements like this: The US Department of Homeland Security is ...
0
votes
2answers
71 views

Do you need to update a router that is set in bridge mode?

Since a router in bridge mode works like a modem, do you need to even update it?
1
vote
1answer
51 views

Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?

I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
11
votes
2answers
29k views

How to be safe from wifikill!

I recently found that my friend is using wifikill apk on his rooted android and I would like to get rid of that software as I always get kicked from my wifi. I have to give him the password of my wifi ...
0
votes
0answers
42 views

Security risks with rogue drivers [duplicate]

A commonly suggested technique to install broadcom drivers on Linux is to download a pre-compiled driver from lwfinger (Source: official ubuntu help page) and install it using a firmware installer. ...
1
vote
1answer
169 views

Alternative to Qubes OS network domain for a server

I know that Qubes Os is not suitable for a server use, but some of its features are quite interesting for that. In fact, all the network drivers are contained in a VM that run a different Linux based ...
0
votes
1answer
387 views

Does SSLSTRIP in MITMF only works when the victim visits for the first time?

I just started learning MITM attacks and I use MITMF to perfom these attacks. I have one question regarding to sslstrip. I notice that sslstrip only works when we first clear the cache and history in ...
0
votes
1answer
185 views

How did I get hacked and what was accessed?

Two days ago I installed a new router. It was a new TPlink AC1900. I established a password for the web admin, went through the quick setup questions, changed the IP ranges for the DHCP service from ...
2
votes
2answers
137 views

Why is my computer connected to amazon instances

When I run the command netstat -a to see the actual connections on my computer, I see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx, not just one address it changes ...
0
votes
0answers
31 views

Snort analyze reply based on request

I'm trying to write a snort rule which detects if certain binary files where requested via HTTP based on a regex rule matching there names. But it should only send an alert if the file exists (e.g. ...
0
votes
1answer
199 views

ARP poisoning NAC

I need some help in understanding the technique of Genians/Trustwave NAC regarding ARP poisoning. As seen here Bypassing Trustwave NAC, it looks like a good method, but I don't simply get it. With ARP ...
1
vote
1answer
104 views

precautions before conducting a penetration test

According to me, The key here is to use virtualization. This is a main precaution that allows safe handling (isolation) of systems that could otherwise be exploited and leveraged as jump points into ...
4
votes
2answers
1k views

How is TSC (TKIP sequence counter) calculated, in WPA?

I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images: ...
0
votes
0answers
3 views

What happens if the localhost does not interpret 127.0.0.1 as the loopback address? [migrated]

For the sake of the example, assume gateway to be 10.0.0.1 and host A (my machine) to be 10.0.0.2. If gateway (10.0.0.1) is running a service bound to a port on localhost only, the service should be ...
2
votes
1answer
68 views

How do ISPs detect whether a phone uses tethering?

I'm trying to figure out how ISPs detect whether a phone uses tethering beyond checking whether the TTL is set to a particular value. Also, do any major ISPs use a form of passive traffic ...
1
vote
0answers
42 views

Is using localhost for sensitive data secure?

I'm working with a nonprofit that wants to use CiviCRM to process its donor, member, and patron personal information. Civi is CMS-based, and will only run via WordPress, Drupal, Joomla, etc. Newb ...
0
votes
1answer
40 views

Why is it possible for all programs / apps to see all network traffic?

I am reading about sandboxing, specifically for Android and Linux based systems (like snap apps). Each app is isolated and can only see its own files, i.e. each app has its own environment. What I don'...
0
votes
2answers
76 views

How to avoid leaking your public IP to installed applications like browsers when using a vpn?

What is the easiest setup to hide your public IP from installed applications and prevent things like WebRTC leaks on a common Linux distro?
1
vote
2answers
64 views

How secure is an IP whitelist compared to other web service security mechanisms like a passphrase?

When securing a web server/web application/website, you often have the choice between choosing something like using a password for authentication/securing a service and creating an IP whitelist or ...
-2
votes
0answers
97 views

Have I been hacked? VS Code Liver Server

I downloaded a foreign program via Git today and wanted to run it. To run it, I had to install the add on "Live Server" on Visual Studio Code. To load the page I had to go live, the page was built ...
8
votes
8answers
1k views

What are the techniques to detect malware call home/beaconing activities?

It is very common for active malware to "call home" (or beaconing), either to fetch updates and instructions or to send back stolen information.. In an internal network where web access to the ...
-2
votes
1answer
44 views

Why does hping3 test DoS not successfully?

I used hping3 to stress test a web app (DoS): sudo hping3 -S --flood -V -p 80 [IP addr/url] When I attempted to get access to the target web application through my network, it refused to connect ...
5
votes
2answers
3k views

TLS- Concept of channel binding

TLS-Handshake is based on public-key cryptography for symmetric key exchange, pki for server-authentication and assume the user authentication is realized trough username and password in the ...
1
vote
1answer
114 views

Should the Router or Firewall Come First?

Network scenario.... I have a typical enterprise network meaning ISP > Edge Router > Firewall|DMZ > Switch > LAN I know there are several debates about what device comes first, but ...
1
vote
0answers
2k views

Peer Entity Authentication and Data Origin Authentication services in OSI layers

What kind of Peer Entity Authentication and Data Origin Authentication services are provided in network layer(L3), Transport layer(L4) and application layer(L7) ?
1
vote
1answer
304 views

Multiple Independent Levels of Security vs Multilevel security

I am looking for a way to isolate two different networks from each other. Suppose we have 2 different networks (public and private). I am looking for a way to connect to these two networks via a ...
0
votes
2answers
91 views

Can a computer/MacBook be compromised/infected/hacker simply be requesting/attempt to join a network?

I was finishing a clean installation of macOS Catalina on my MacBook, and I was asked to select a wifi network. I misclicked on a wifi network with a name that's very similar to mine and was asked to ...
1
vote
1answer
169 views

non-rfc1918 address appeared on router dashboard

Quick context: Home network, performing some DPI on my perimeter router (Ubiquiti EdgeRouter Lite) that governs 2 internal subnets separating my traffic from a bunch of roommate devices. No IDS on the ...
0
votes
2answers
279 views

Is it possible to detect someone impersonating a device in my wifi network?

If an intruder gained access to a network impersonating the MAC address and the device name to appear like a familiar device in the network, how then is it possible to detect the device in the router ...
5
votes
4answers
5k views

Private Tor networks: what are the benefits, and how would it be accomplished?

What are the benefits of someone building a private Tor network? ...One that is disconnected from the well-known network being used on the Internet at-large. My intent is to make Tor more corporate-...
1
vote
2answers
115 views

What are the potential security risks of using a commercial VPN service?

Commercial VPN services are gaining a lot of popularity and some of them are heavily advertising their products on social media networks and technology magazines today. The advantages of using such ...
0
votes
0answers
22 views

Circumventing inbound traffic rule by faking reply traffic

My question is about security groups/firewalls and protecting a virtual private cloud from the external world. Here is a description of VPC default policy for inbound/outbound traffic (on AWS): ...
0
votes
3answers
940 views

rdp connection with netcat pivoting [closed]

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...

1
2 3 4 5
52