Darknet and Black Hole Monitoring a Journey into Typographic Errors
|
|
|
- Jack Rich
- 9 years ago
- Views:
Transcription
1 Darknet and Black Hole Monitoring a Journey into Typographic Errors Alexandre Dulaunoy CIRCL - TLP:WHITE Team CIRCL - Team Restena 12 May Honeynet Project Workshop
2 Motivation and background IP darkspace or black hole is Routable non-used address space of an ISP (Internet Service Provider), incoming traffic is unidirectional and unsolicited. Is there any traffic in those darkspaces? If yes, what and why does it arrive there? And on purpose or by mischance? What s the security impact? What are the security recommendations? 2 of 19
3 Origin of traffic in the black hole Attackers (and researchers) scan networks to find vulnerable systems (e.g. SSH brute-force) Backscatter traffic (e.g. from spoofed DoS) Self-replicating code using network as a vector (e.g. conficker, residual worms) Badly configured devices especially embedded devices (e.g. printers, server, routers) Our IP-darkspace is especially suited for spelling errors from the RFC1918 (private networks) address space 3 of 19
4 Why is there traffic Typing/Spelling errors with RFC1918 networks While typing an IP address, different error categories might emerge: Hit wrong key 192.x.z.y 193.x.y.z 172.x.y.z 152.x.y.z Omission of number 192.x.y.z 12.x.y.z Doubling of keys 10.a.b.c 100.a.b.c 4 of 19
5 Research activities related to spelling errors Spelling errors apply to text but also network configuration 34% omissions of 1 character Example: Network Netork 23% of all errors happen on 3rd position of a word Example: Text Test) 94% spellings errors are single errors in word And do not reappear References Pollock J. J. and Zamora A., Collection and characterization of spelling errors in scientific and scholarly text. J. Amer. Soc. Inf. Sci. 34, 1, 51 58, Kukich K., Techniques for automatically correcting words in text. ACM Comput. Surv. 24, 4, , of 19
6 IP-Darkspace: Data Collection Implementation tcpdump socat (SSL/TLS) socat (SSL/TLS) tcpdump file:sensorid/yy-mm-dd file:sensorid/yy-mm-dd... processor Minimal sensor collecting IP-Darkspace networks (close to RFC1918 address space) Raw pcap are captured with the full payload Netbeacon a developed to ensure consistent packet capture a 6 of 19
7 Dataset collected and statistics From until Today (still active) Nearly 200 gigabytes of compressed raw pcap collected Constant stream of packets from two /22 network blocks no day/night profile. Some peaks at 800kbit/s (e.g. often TCP RST from backscatter traffic but also from typographic errors) 7 of 19
8 General observations A large part of traffic is coming from badly configured devices (RFC1918 spelling errors) Printers, embedded devices, routers or even server. Trying to do name resolution on non-existing DNS servers, NTP or sending syslog messages. Even if the black hole is passive, payload of stateless UDP packets or even TCP (due to asymmetric routing on misspelled network) datagrams are present Internal network scanning and reconnaissance tool (e.g. internal network enumeration) 8 of 19
9 Observation per AS Traffic seen in the darknet N Frequency ASN Occurrences of activities matching the proportion of hosts in a country. Chinese great-wall is not filtering leaked packets. 9 of 19
10 Network reconnaissance (and potential misuse): DNS 3684 _msdcs.<companyname>.local time.euro.apple.com 104 time.euro.apple.com.<mylocaldomain> 122 ocsp.tcs.terena.org ocsp.<variousca> DNS queries to an incorrect nameserver could lead to major misuse A single typo in a list of 3 nameservers is usually unnoticed 10 of 19
11 A/V Statistics from Misconfigured Resolvers KASPERSKY AVAST KASPERSKY-LABS SYMANTEC MCAFEE SYMANTECLIVEUPDATE TRENDMICRO BITDEFENDER AVG COMODO SOPHOSXL SOPHOS F-SECURE DRWEB PANDASECURITY PANDADOMAINADVISOR KINGSOFT SYMANTECCLOUD PANDASOFTWARE CLAMAV SYMANTECMAIL AVGMOBILATION RISING KASPERSKYLABS FORTINET MCAFEESECURE NPROTECT NORMAN PANDA AVGCLOUD BAIDU PANDAAPP GDATASECURITY NPROTECT2 MALWAREBYTES MCAFEEMOBILESECURITY MCAFEEASAP AVGTHREATLABS AVGATE PANDAPOST BITDEFENDER-ES 11 of 19
12 Certificate Revocation and Queries from Misconfigured Resolvers The increase of 5% in late 2013 might be due to certificate requirements update (e.g. key size, hashing algorithm updates) A lot of software assumes a certificate to be valid when OCSP or CRL are not accessibles OCSP/CRL Requests Queries Sources Frequency Month 12 of 19
13 Software Updates/Queries from Misconfigured Resolvers Discovering software usage (and vulnerabilities) can be easily done with passive reconnaissance Are the software update process ensuring the integrity of the updates? Update Requests Apple Product Requests Queries Sources Queries Sources Frequency Frequency Month Month 13 of 19
14 Network Reconnaissance - How To Build Smart DNS Brute-Forcer ASTTF.NET ASUEGYI.INFO ASUS1025C DEFAULT DELICIOUS.COM DELL DELL1400 DELL DELL7777 DELL-PC DELLPOP3 HELP.163.COM HP CLIENT1 MACBOOKAIR-CAD7 MACBOOK-B5BA66 MACBOOKPRO-5357 MAIL.AFT20.COM S3.QHIMG.COM SERVERWEB SERVEUR SERVICE.QQ.COM SMTP.163.COM And many more of 19
15 Network Reconnaissance: NetBios Machine Types (1 week) 23 Browser Server 4 Client? 1 Client? M <ACTIVE> 21 Domain Controller 1 Domain Controller M <ACTIVE> 11 Master Browser 1 NameType=0x00 Workstation 1 NameType=0x20 Server 105 Server 26 Unknown 1 Unknown <GROUP> B <ACTIVE> 5 Unknown <GROUP> M <ACTIVE> 1322 Workstation 1 Workstation M <ACTIVE> 15 of 19
16 Printer syslog to the world or how to tell to the world your printer status :00:42 SYSLOG lpr.error printer: offline or intervention needed :51: SYSLOG lpr.error printer: paper out :14: SYSLOG lpr.error printer: paper jam Printers are just an example out of many syslog messages from various devices Information leaked could be used by attackers to gain more information or improve targeted attacks 16 of 19
17 How to configure your router (without security) Enable command logging and send the logs to a random syslog server Aug 13 10:11:51 M6000-G5 command-log:[10:11: VtyNo: vty1 UserName: XXX IP: XXX ReturnCode: 1 CMDLine: show subscriber interface gei-0/2/1/12.60 Aug 13 10:46:05 M6000-G5 command-log:[10:46: VtyNo: vty2 UserName: XXX IP: XXX ReturnCode: 1 CMDLine: conf t ] Aug 13 10:46:10 M6000-G5 command-log:[10:46: VtyNo: vty2 UserName: XXX IP: XXX ReturnCode: 1 CMD Line: aaa-authentication-template 1100 ]... We will let you guess the sensitive part afterwards of 19
![60 Aug 13 10:46:05 M6000-G5 command-log:[10:46:05 08-13-2012 VtyNo: vty2 UserName: XXX IP: XXX ReturnCode: 1 CMDLine: conf t ] Aug 13 10:46:10 M6000-G5](/docs-images/49/16589099/images/page_17.jpg "command-log:[10:46:10 08-13-2012 VtyNo: vty2 UserName: XXX IP: XXX ReturnCode: 1 CMD Line: aaa-authentication-template 1100 ].")
18 Misconfigured network interception in Iran for 2 hours? On April 08, 2013, a peak of ICMP time exceeded in-transit were received during 2 hours IP sources allocated in Iran with a nice distribution among Iranian Internet providers 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length 36 12:29: IP > a.b.100.1: ICMP time exceeded in - transit, length of 19
19 Conclusions Security recommendations Default routing/nat to Internet in operational network is evil Use fully qualified domain names (resolver search list is evil too) Double check syslog exports via UDP (e.g. information leakage is easy) Verify any default configuration with SNMP (e.g. enable by default on some embedded devices) Offensive usage? What does it happen if a malicious ISP responds to misspelled RFC1918 addresses? (e.g. DNS/NTP requests, software update or proxy request) Some research projects on this topic? Contact us 19 of 19
8 steps to protect your Cisco router
8 steps to protect your Cisco router Daniel B. Cid [email protected] Network security is a completely changing area; new devices like IDS (Intrusion Detection systems), IPS (Intrusion Prevention
A perspective to incident response or another set of recommendations for malware authors
A perspective to incident response or another set of recommendations for malware authors Alexandre Dulaunoy - TLP:WHITE [email protected] June 7, 2013 CIRCL, national CERT of Luxembourg CIRCL
Internet Measurement Research
Internet Measurement Research Matthäus Wander Kassel, October 1, 2013 Overview How to get measurement data? Research projects Case studies of past projects Ideas and inspiration
Security Toolsets for ISP Defense
Security Toolsets for ISP Defense Backbone Practices Authored by Timothy A Battles (AT&T IP Network Security) What s our goal? To provide protection against anomalous traffic for our network and it s customers.
Guide to DDoS Attacks December 2014 Authored by: Lee Myers, SOC Analyst
INTEGRATED INTELLIGENCE CENTER Technical White Paper William F. Pelgrin, CIS President and CEO Guide to DDoS Attacks December 2014 Authored by: Lee Myers, SOC Analyst This Center for Internet Security
Strategies to Protect Against Distributed Denial of Service (DD
Strategies to Protect Against Distributed Denial of Service (DD Table of Contents Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks...1 Introduction...1 Understanding the Basics
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained
home Network Vulnerabilities Detail Report Grouped by Vulnerability Report Generated by: Symantec NetRecon 3.5 Licensed to: X Serial Number: 0182037567 Machine Scanned from: ZEUS (192.168.1.100) Scan Date:
Traffic Monitoring : Experience
Traffic Monitoring : Experience Objectives Lebah Net To understand who and/or what the threats are To understand attacker operation Originating Host Motives (purpose of access) Tools and Techniques Who
Classification of Firewalls and Proxies
Classification of Firewalls and Proxies By Dhiraj Bhagchandka Advisor: Mohamed G. Gouda ([email protected]) Department of Computer Sciences The University of Texas at Austin Computer Science Research
F-SECURE MESSAGING SECURITY GATEWAY
F-SECURE MESSAGING SECURITY GATEWAY DEFAULT SETUP GUIDE This guide describes how to set up and configure the F-Secure Messaging Security Gateway appliance in a basic e-mail server environment. AN EXAMPLE
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs
Overview of Network Security The need for network security Desirable security properties Common vulnerabilities Security policy designs Why Network Security? Keep the bad guys out. (1) Closed networks
Firewall Firewall August, 2003
Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP
Intrusion Detection System Based Network Using SNORT Signatures And WINPCAP Aakanksha Vijay M.tech, Department of Computer Science Suresh Gyan Vihar University Jaipur, India Mrs Savita Shiwani Head Of
- Basic Router Security -
1 Enable Passwords - Basic Router Security - The enable password protects a router s Privileged mode. This password can be set or changed from Global Configuration mode: Router(config)# enable password
Firewalls. Firewalls. Idea: separate local network from the Internet 2/24/15. Intranet DMZ. Trusted hosts and networks. Firewall.
Firewalls 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible servers and networks 2 1 Castle and
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus. February 3, 2015 (Revision 4)
Comprehensive Malware Detection with SecurityCenter Continuous View and Nessus February 3, 2015 (Revision 4) Table of Contents Overview... 3 Malware, Botnet Detection, and Anti-Virus Auditing... 3 Malware
DNS security: poisoning, attacks and mitigation
DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain
QUESTION: 1 Which of the following are valid authentication user group types on a FortiGate unit? (Select all that apply.)
1 Fortinet - FCNSA Fortinet Certified Network Security Administrator QUESTION: 1 Which of the following are valid authentication user group types on a FortiGate unit? (Select all that apply.) A. Firewall
Introduction to Network Security Lab 1 - Wireshark
Introduction to Network Security Lab 1 - Wireshark Bridges To Computing 1 Introduction: In our last lecture we discussed the Internet the World Wide Web and the Protocols that are used to facilitate communication
The Cisco IOS Firewall feature set is supported on the following platforms: Cisco 2600 series Cisco 3600 series
Cisco IOS Firewall Feature Set Feature Summary The Cisco IOS Firewall feature set is available in Cisco IOS Release 12.0. This document includes information that is new in Cisco IOS Release 12.0(1)T, including
Network Traffic Analysis
2013 Network Traffic Analysis Gerben Kleijn and Terence Nicholls 6/21/2013 Contents Introduction... 3 Lab 1 - Installing the Operating System (OS)... 3 Lab 2 Working with TCPDump... 4 Lab 3 - Installing
Passive Vulnerability Detection
Page 1 of 5 Passive Vulnerability Detection "Techniques to passively find network security vulnerabilities" Ron Gula [email protected] September 9, 1999 Copyright 1999 Network Security Wizards
Lab PC Network TCP/IP Configuration
Lab PC Network TCP/IP Configuration Objective Identify tools used to discover a computer network configuration with various operating systems. Gather information including connection, host name, Layer
Firewall. FortiOS Handbook v3 for FortiOS 4.0 MR3
Firewall FortiOS Handbook v3 for FortiOS 4.0 MR3 FortiOS Handbook Firewall v3 24 January 2012 01-432-148222-20120124 Copyright 2012 Fortinet, Inc. All rights reserved. Contents and terms are subject to
iscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi
iscsi Security (Insecure SCSI) Presenter: Himanshu Dwivedi Agenda Introduction iscsi Attacks Enumeration Authorization Authentication iscsi Defenses Information Security Partners (isec) isec Partners Independent
How To Stop A Malicious Dns Attack On A Domain Name Server (Dns) From Being Spoofed (Dnt) On A Network (Networking) On An Ip Address (Ip Address) On Your Ip Address On A Pc Or Ip Address
DNS Amplification Are YOU Part of the Problem? (RIPE66 Dublin, Ireland - May 13, 2013) Merike Kaeo Security Evangelist, Internet Identity [email protected] INTRO Statistics on DNS Amplification
Network Security CS 192
Network Security CS 192 Network Scanning (Idlescan) Department of Computer Science George Washington University Jonathan Stanton 1 Today s topics Discussion of new DNS flaws Network Scanning (Idlescan)
Chapter 3 LAN Configuration
Chapter 3 LAN Configuration This chapter describes how to configure the advanced LAN features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. This chapter contains the following sections
Basic Network Configuration
Basic Network Configuration 2 Table of Contents Basic Network Configuration... 25 LAN (local area network) vs WAN (wide area network)... 25 Local Area Network... 25 Wide Area Network... 26 Accessing the
4. Getting started: Performing an audit
4. Getting started: Performing an audit Introduction Security scans enable systems administrators to identify and assess possible risks within a network. Through GFI LANguard N.S.S. this is performed automatically,
Firewall Server 7.2. Release Notes. What's New in Firewall Server 7.2
Firewall Server 7.2 Release Notes BorderWare Technologies is pleased to announce the release of version 7.2 of the Firewall Server. This release includes the following new features and improvements. What's
Setting Up Scan to SMB on TaskALFA series MFP s.
Setting Up Scan to SMB on TaskALFA series MFP s. There are three steps necessary to set up a new Scan to SMB function button on the TaskALFA series color MFP. 1. A folder must be created on the PC and
SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide with Enhanced Logging
SonicOS 5.9 / 6.0.5 / 6.2 Log Events Reference Guide with Enhanced Logging 1 Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your system. CAUTION:
HP Intelligent Management Center v7.1 Network Traffic Analyzer Administrator Guide
HP Intelligent Management Center v7.1 Network Traffic Analyzer Administrator Guide Abstract This guide contains comprehensive information for network administrators, engineers, and operators working with
General Network Security
4 CHAPTER FOUR General Network Security Objectives This chapter covers the following Cisco-specific objectives for the Identify security threats to a network and describe general methods to mitigate those
EXPLORER. TFT Filter CONFIGURATION
EXPLORER TFT Filter Configuration Page 1 of 9 EXPLORER TFT Filter CONFIGURATION Thrane & Thrane Author: HenrikMøller Rev. PA4 Page 1 6/15/2006 EXPLORER TFT Filter Configuration Page 2 of 9 1 Table of Content
7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?
7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk
Linux Network Security
Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols
Overview - Using ADAMS With a Firewall
Page 1 of 6 Overview - Using ADAMS With a Firewall Internet security is becoming increasingly important as public and private entities connect their internal networks to the Internet. One of the most popular
IBM. Vulnerability scanning and best practices
IBM Vulnerability scanning and best practices ii Vulnerability scanning and best practices Contents Vulnerability scanning strategy and best practices.............. 1 Scan types............... 2 Scan duration
IBM Security QRadar Version 7.2.0. Common Ports Guide
IBM Security QRadar Version 7.2.0 Common Ports Guide Note: Before using this information and the product that it supports, read the information in Notices and Trademarks on page 11. Copyright IBM Corp.
CS 665: Computer System Security. Network Security. Usage environment. Sources of vulnerabilities. Information Assurance Module
CS 665: Computer System Security Network Security Bojan Cukic Lane Department of Computer Science and Electrical Engineering West Virginia University 1 Usage environment Anonymity Automation, minimal human
Attack and Defense Techniques
Network Security Attack and Defense Techniques Anna Sperotto, Ramin Sadre Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Attack Taxonomy Many different kind of
Wharf T&T Limited DDoS Mitigation Service Customer Portal User Guide
Table of Content I. Note... 1 II. Login... 1 III. Real-time, Daily and Monthly Report... 3 Part A: Real-time Report... 3 Part 1: Traffic Details... 4 Part 2: Protocol Details... 5 Part B: Daily Report...
Step-by-Step Configuration
Step-by-Step Configuration Kerio Technologies Kerio Technologies. All Rights Reserved. Printing Date: August 15, 2007 This guide provides detailed description on configuration of the local network which
Session Hijacking Exploiting TCP, UDP and HTTP Sessions
Session Hijacking Exploiting TCP, UDP and HTTP Sessions Shray Kapoor [email protected] Preface With the emerging fields in e-commerce, financial and identity information are at a higher risk of being
IDS 4.0 Roadshow. Module 1- IDS Technology Overview. 2003, Cisco Systems, Inc. All rights reserved. IDS Roadshow
IDS 4.0 Roadshow Module 1- IDS Technology Overview Agenda Network Security Network Security Policy Management Protocols The Security Wheel IDS Terminology IDS Technology HIDS and NIDS IDS Communication
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík
Network Security Monitoring and Behavior Analysis Pavel Čeleda, Petr Velan, Tomáš Jirsík {celeda velan jirsik}@ics.muni.cz Part I Introduction P. Čeleda et al. Network Security Monitoring and Behavior
Flow Analysis Versus Packet Analysis. What Should You Choose?
Flow Analysis Versus Packet Analysis. What Should You Choose? www.netfort.com Flow analysis can help to determine traffic statistics overall, but it falls short when you need to analyse a specific conversation
How To Understand A Network Attack
Network Security Attack and Defense Techniques Anna Sperotto (with material from Ramin Sadre) Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Attacks! Many different
SCADA Security Example
SCADA Security Example Christian Paulino and Janusz Zalewski Florida Gulf Coast University December 2012 1. Introduction SCADA systems are always connected to a network, so they are vulnerable to attack.
20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB
REPORT ON AUDIT OF LOCAL AREA NETWORK OF C-STAR LAB Conducted: 29 th March 5 th April 2007 Prepared By: Pankaj Kohli (200607011) Chandan Kumar (200607003) Aamil Farooq (200505001) Network Audit Table of
Cyber Essentials. Test Specification
Cyber Essentials Test Specification Contents Scope of the Audit...2 Assumptions...3 Success Criteria...3 External systems...4 Required tests...4 Test Details...4 Internal systems...7 Tester pre-requisites...8
Configuring SSL VPN on the Cisco ISA500 Security Appliance
Application Note Configuring SSL VPN on the Cisco ISA500 Security Appliance This application note describes how to configure SSL VPN on the Cisco ISA500 security appliance. This document includes these
Payment Card Industry (PCI) Executive Report 08/04/2014
Payment Card Industry (PCI) Executive Report 08/04/2014 ASV Scan Report Attestation of Scan Compliance Scan Customer Information Approved Scanning Vendor Information Company: A.B. Yazamut Company: Qualys
Practical Network Forensics
BCS-ISSG Practical Network Forensics Day BCS, London Practical Network Forensics Alan Woodroffe [email protected] www.securesystemssupport.co.uk Copyright Secure Systems Support Limited.
Chapter 7. Address Translation
Chapter 7. Address Translation This chapter describes NetDefendOS address translation capabilities. Dynamic Network Address Translation, page 204 NAT Pools, page 207 Static Address Translation, page 210
Packet Capture. Document Scope. SonicOS Enhanced Packet Capture
Packet Capture Document Scope This solutions document describes how to configure and use the packet capture feature in SonicOS Enhanced. This document contains the following sections: Feature Overview
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
TELE 301 Network Management. Lecture 17: File Transfer & Web Caching
TELE 301 Network Management Lecture 17: File Transfer & Web Caching Haibo Zhang Computer Science, University of Otago TELE301 Lecture 17: File Transfer & Web Caching 1 Today s Focus FTP & Web Caching!
Topics in Network Security
Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure
Payment Card Industry (PCI) Executive Report. Pukka Software
Payment Card Industry (PCI) Executive Report For Pukka Software Primary Contact: Brian Ghidinelli none Los Gatos, California United States of America 415.462.5603 Payment Card Industry (PCI) Executive
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda How do you
Attack Lab: Attacks on TCP/IP Protocols
Laboratory for Computer Security Education 1 Attack Lab: Attacks on TCP/IP Protocols Copyright c 2006-2010 Wenliang Du, Syracuse University. The development of this document is funded by the National Science
How To Set Up A Network Map In Linux On A Ubuntu 2.5 (Amd64) On A Raspberry Mobi) On An Ubuntu 3.5.2 (Amd66) On Ubuntu 4.5 On A Windows Box
CSC-NETLAB Packet filtering with Iptables Group Nr Name1 Name2 Name3 Date Instructor s Signature Table of Contents 1 Goals...2 2 Introduction...3 3 Getting started...3 4 Connecting to the virtual hosts...3
Implementing Secure Converged Wide Area Networks (ISCW)
Implementing Secure Converged Wide Area Networks (ISCW) 1 Mitigating Threats and Attacks with Access Lists Lesson 7 Module 5 Cisco Device Hardening 2 Module Introduction The open nature of the Internet
Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks
Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks Document ID: 13634 Contents Introduction Understanding the Basics of DDoS Attacks Characteristics of Common Programs Used to Facilitate
642 552 Securing Cisco Network Devices (SND)
642 552 Securing Cisco Network Devices (SND) Course Number: 642 552 Length: 1 Day(s) Course Overview This course is part of the training for the Cisco Certified Security Professional, Cisco Firewall Specialist,
Desktop Security. Overview and Technology Guidance. Michael Ramsey Network Specialist, NC DPI
Desktop Security Overview and Technology Guidance Michael Ramsey Network Specialist, NC DPI Desktop Security Best practices for both the technical type and the typical user Defensive Layering Top Vulnerabilities
Frequent Denial of Service Attacks
Frequent Denial of Service Attacks Aditya Vutukuri Science Department University of Auckland E-mail:[email protected] Abstract Denial of Service is a well known term in network security world as
Firewall Troubleshooting
Firewall Troubleshooting (Checkpoint Specific) For typical connectivity issues where a firewall is in question follow these steps to eliminate any issues relating to the firewall. Firewall 1. From the
Network Monitoring On Large Networks. Yao Chuan Han (TWCERT/CC) [email protected]
Network Monitoring On Large Networks Yao Chuan Han (TWCERT/CC) [email protected] 1 Introduction Related Studies Overview SNMP-based Monitoring Tools Packet-Sniffing Monitoring Tools Flow-based Monitoring
Firewalls. Pehr Söderman KTH-CSC [email protected]
Firewalls Pehr Söderman KTH-CSC [email protected] 1 Definition A firewall is a network device that separates two parts of a network, enforcing a policy for all traversing traffic. 2 Fundamental requirements
Multifaceted Approach to Understanding the Botnet Phenomenon
Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic
Looking for Trouble: ICMP and IP Statistics to Watch
Looking for Trouble: ICMP and IP Statistics to Watch Laura Chappell, Senior Protocol Analyst Protocol Analysis Institute [[email protected]] www.packet-level.com www.podbooks.com HTCIA Member,
DVR Network Security
DVR Network Security Page 1 of 12 Table of Contents TABLE OF CONTENTS... 2 GETTING STARTED... 4 INTRODUCTION... 4 DISCLAIMER... 4 BACKGROUND INFORMATION... 4 GENERAL BEST PRACTICES... 4 USE THE EQUIPMENT
Client Server Registration Protocol
Client Server Registration Protocol The Client-Server protocol involves these following steps: 1. Login 2. Discovery phase User (Alice or Bob) has K s Server (S) has hash[pw A ].The passwords hashes are
How to protect your home/office network?
How to protect your home/office network? Using IPTables and Building a Firewall - Background, Motivation and Concepts Adir Abraham [email protected] Do you think that you are alone, connected from
FortKnox Personal Firewall
FortKnox Personal Firewall User Manual Document version 1.4 EN ( 15. 9. 2009 ) Copyright (c) 2007-2009 NETGATE Technologies s.r.o. All rights reserved. This product uses compression library zlib Copyright
Challenges in NetFlow based Event Logging
Challenges in NetFlow based Event Logging Stefan Künkel IsarNet [email protected] 31.03.2012 Agenda Introduction Getting Events Example NSEL What is it? Analysis Example CGN Motivation NAT overview NAT Logging
Description: Objective: Attending students will learn:
Course: Introduction to Cyber Security Duration: 5 Day Hands-On Lab & Lecture Course Price: $ 3,495.00 Description: In 2014 the world has continued to watch as breach after breach results in millions of
Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN
Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts
Detecting rogue systems
Product Guide Revision A McAfee Rogue System Detection 4.7.1 For use with epolicy Orchestrator 4.6.3-5.0.0 Software Detecting rogue systems Unprotected systems, referred to as rogue systems, are often
Barracuda Networks Web Application Firewall
McAfee Enterprise Security Manager Data Source Configuration Guide Data Source: Barracuda Networks Web Application Firewall January 30, 2015 Barracuda Networks Web Application Firewall Page 1 of 10 Important
Fully supported Antivirus software (Managed Antivirus)
You are here: Antivirus > Managed Antivirus Vendors Fully supported Antivirus software (Managed Antivirus) Antivirus (AV) vendors often release software updates. We hard-code the update into our RMM agent
Why Leaks Matter. Leak Detection and Mitigation as a Critical Element of Network Assurance. A publication of Lumeta Corporation www.lumeta.
Why Leaks Matter Leak Detection and Mitigation as a Critical Element of Network Assurance A publication of Lumeta Corporation www.lumeta.com Table of Contents Executive Summary Defining a Leak How Leaks
Security vulnerabilities in the Internet and possible solutions
Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in
The HoneyNet Project Scan Of The Month Scan 27
The HoneyNet Project Scan Of The Month Scan 27 23 rd April 2003 Shomiron Das Gupta [email protected] 1.0 Scope This month's challenge is a Windows challenge suitable for both beginning and intermediate
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant What infrastructure security really means? Infrastructure Security is Making sure that your system services are always running
Firewalls and Intrusion Detection
Firewalls and Intrusion Detection What is a Firewall? A computer system between the internal network and the rest of the Internet A single computer or a set of computers that cooperate to perform the firewall
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
Chapter 4 Security and Firewall Protection
Chapter 4 Security and Firewall Protection This chapter describes how to use the Security features of the ProSafe Wireless ADSL Modem VPN Firewall Router to protect your network. These features can be
Chapter 8 Router and Network Management
Chapter 8 Router and Network Management This chapter describes how to use the network management features of your ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN. These features can be found by
How to launch and defend against a DDoS
How to launch and defend against a DDoS John Graham-Cumming October 9, 2013 The simplest way to a safer, faster and smarter website DDoSing web sites is... easy Motivated groups of non-technical individuals