Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 12 years ago.
Improve this question
I have been a .net developer for the past three yrs. Just curious to know about the network security field. What kind of work does the developers working in these area do? I really have not much idea about network security but what my understanding is these people are involved in securing network, preventing attacks on network as obvious. Could any one please give me some details about this field and also what does it take to move to this field.
Take a look at "Security Engineering" by Ross Anderson. The first edition and part of the second are available for free online here. While he talks about many non-network issues, the principles mostly apply.
Network security is a vast subject. On the developer side, I think you would most likely be concerning yourself with lots of encryption schemes and process security. There are basic things like using SSL for network traffic of a program to more advanced subjects like preventing any traces of a sensitive operation from remaining in RAM after a program has processed (and probably encrypted) it.
Today, you would need to become an expert in TCP/IP protocols. Everything from ARP, DNS, UDP, ICMG, BGP, and on and on. Most networks are IP-based, with IP-based firewalls. The firewalls will allow, for example, "TCP traffic on port 80" to come through. You need to be able to understand if that traffic is valid web surfing, DOS attack, or otherwise malicious. This can only be accomplished with detailed understanding of how IP networks work. Ditto for other protocols like DNS. In addition, lower-level understanding of ethernet communications and other means of transport (like cell phone networks or WiFi networks) would be important. I suppose it depending on what you mean by "network security" - to me this is below the application layer.
Related
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 7 years ago.
Improve this question
After finding someones ip you can easily send pings to them to make DOS attacks. Me and my friend tried to make a defense against them and wanted to know how a low level attacker can send this DOS attacks. When one of us sent pings to the other using cmd when we were connected to the same modem(wifi) it succeed in sending pings. But when we were on different networks it failed and sent a message like "Request timed out". I assume this is a failure message but I've some questions in this matter.
I won't write the command to make DOS attacks since I don't want to encourage anyone in making those and anyone who is knowledgeable in this subject already knows how to do that.
//Assume that attacker knows the ip of the victim.
Questions
Can a computer be successful enough to slow down the second computer if he sends infinite pings? If so in how much time(approximately.)(assume their computers are same.) What can be the worst result for the victim?
How can someone be successful in making DOS attacks to people who are connected into different networks from cmd? And how can I take measures against them?
This will not work over the internet if the victim's router is set not to send ICMP replies to ping requests.
Can a computer be successful enough to slow down the second computer
if he sends infinite pings? If so in how much
time(approximately.)(assume their computers are same.) What can be the
worst result for the victim?
Not significantly. What you need is an amplification attack - that is the victim's computer has to do more work than you for each request. Sending a reply to a ping is minimal work and involves sending the same amount of bytes back, so you are not slowing the victim machine anymore than your own.
How can someone be successful in making DOS attacks to people who are
connected into different networks from cmd? And how can I take
measures against them?
You would be better off using a software tool to do this, or by setting up a botnet to do a distributed denial of service instead (DDoS). Usage of such tools are probably illegal depending on your jurisdiction and you should get full permission if testing this from the owners of all networks and systems where your traffic would flow.
Mitigating DDoS is the million dollar question. Services such as CloudFlare can help. It all depends on what you need to protect and who from.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
I'm a regular user of your website but I never asked a question. I hope, it's a good way. For some weeks, I have special DDoS attacks on a website. I don't know what kind of attack they are and how is it possible to launch them. The question is not how to block them, I know this, but what kind of attack it is and how is it possible. I think it's flood DDOS attack, but how this one?
For some weeks, 3 times, I had on my website thousands and thousands gets (+/- 10,000/min, during 30 minutes, to make down my server), such as :
index.php/q=99999, all queries are different and existing on the website;
all IP are the same per attack (only one IP per attack, and the 3 IP used for each of these attacks are in the same segment xxx.xxx.xxx... From a same host in another country, which doesn't have link or competition or anything with my site.
the user-agents are different (+/- 40 different agents per attack, never two times the same successively, but all of them same time.)
I don't think that the IP sources are really the attackers, because, it's little stupid to use all the same IP for such attack. But I think that the hackers want to make me think that the attacks are really coming from these IP.
But, if these IP sources are not real, how is it possible to launch such attack, with +/- 40 different agents, coming from the same IP in same time. Is-it easy to do that? does it need big systems? A single hacker could do that? Or such services are cheap and existing on the net?....
I can block such attacks but I try to understand the goal, the meaning of them and how they do that. To block only is not enough. I need to understand. If you cannot help, maybe advise me where I could find the information.
Thank you so much.
It does sound like an attack alright. It's not hard to pull off, nor set up. These kinds of attacks are usually done via computer farm or a zombie horde, and as such it's fairly easy to set up, and as a result to that, it's a service offered online.
People do this because they can or because of a personal and/or business vendetta.
I could write about this topic for hours, but none of it wouldn't have been said before. So allow me to forward you to some further reading on the topic.
For a quick and dirty overview:
Tom's hardware entry on the topic is also a nice, condensed, straight to the point write up, which I've found useful in the past.
A more detailed, yet broad overview of DDoS attacks and protection:
Wikipedia's article on Distributed Denial of Service attacks is extremely well written and updated. I suggest you start there.
If you're serious about defending yourself/ educating yourself: CISCO's article on how to defend yourself against DDoS. It's extremely detailed and long and useful. I've come back to it several times over the years for help on the topic -- both academically and professionally.
Good luck!
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
Using the popular torrent backdoor come.in as an example, why are only the sub domains being blocked by ISP's?
Originally my ISP blocked eztv.it so I found eztv.come.in which was eventually blocked after some time only to be replaced with ezztv.come.in.
They are now on ezzzztv.come.in and no doubt in time they will be on ezzzzzzzztv.
They also have backdoors to all the other big torrent sites and do the same thing, just open up again with a new sub domain URL
Is there some kind of technical reason that the main domain is not being blocked? Or maybe it's a legal reason. I am no expert but can't think of a logical reason the main domain is not being blocked instead of the ISP playing this cat and mouse game.
I doubt it's anything too mysterious. I'd say it depends heavily on how they are doing the blocking and I'm willing to bet this changes a good bit from ISP to ISP. I would guess that it's one of the following:
1) They get hostnames to block from some source (some kind of commercial feed maybe?), this source gives them the subdomains (i.e. specific hosts instead of a group of hosts), they import this to some list that gets blocked
2) Plain old ignorance or laziness - maybe whatever team is in charge of this just blocks based on hosts because they don't care enough to do basic pattern recognition on hosts they're ordered to block.
3) Technical reasons - maybe whatever tool they use to manage their blacklists only accepts subdomains?
Unless we get someone that does this kind of work for ISPs (and they do it the same way as you are describing), then we'll never know :-)
I do not know why the subdomains are being blocked, however I do know that using a encrypted VPN such as HotspotShield means that your ISPs cannot know what you are visiting (And therefore would have to either block everything or nothing), which means that you can bypass that block.
When I accidentally forgot to pay the bill (Was overdrawn) and my ISP limited me to only Google and Youtube, I used a VPN and was able to access everything fine.
I have only ever used HotspotShield, never used TOR, etc, so I don't know which VPNs it would work with or not (really the question is, which VPNs are encrypted?).
VPNs give higher latency, but to my knowledge do not give slower download speeds (Except if the VPN has a slower internet connection than you), so should be fine for downloads.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
I don't fully understand how packet sniffing works, but the gist I get from it is that if someone is logged on the same network as you, they can sniff packets for unhashed passwords and... well, that's really enough damage.
The solution, I've read, is to only go on networks that are secure when doing bank stuff, but my issue is that the only secure network I have is a school wide one (dorms). Imaginably, the school wouldn't set up a network so open to password theft, but the only thing I can think of stopping the bad guys is that we log in with our student ID. All they would need is someone else's ID and password and (if my understanding is correct) they could packet sniff pretty much everyone in the hall using the same router without being traced.
Are my fears justified, and if not why? And if so, also why?
Thank you
Speaking generally, you can't sniff transmissions between a client and a bank server since the communication uses public key encryption. That said, SSL is still vulnerable to man-in-the-middle attacks - beware of notices/alerts about unrecognized certificates.
Regarding privacy on non-HTTPS websites, it depends on how your network is set up. If it's a standard WPA2 setup then all of your unencrypted traffic is visible (easily) to anyone who is in transmission range of your computer and has the WiFi password. You can install HTTPS Everywhere from EFF (https://www.eff.org/https-everywhere‎) which helps secure your communications on many common websites - Facebook, Twitter, etc.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 11 years ago.
Improve this question
I have a client app that faces the internet, but only clients will access. The site should never be indexed or crawled or viewed outside of our clients. We always concerned about DDOS and attempts to gain access. If the system can add one more level of being hidden, or harder to find, I don't see the negatives.
Users will never have to enter the domain name (think kiosks), and admins can use bookmarks. Yes, security by obscurity is no solution and never relied upon. But if you can add it to an existing and robust secured system, why not?
Is there any downside to having a random domain name like j398sh3-3nj23j.com?
I would love to hear some thoughts and opinions.
If you're never using where anyone will see it (even by rDNS on an incoming connection from your server), then the only real drawback is that you're paying for it when you could as easily use a random subdomain under a domain you already control (e.g. j398sh3-3nj23j.example.com).
But it'll provide zero protection from DDOS or attempts to gain access, as anyone who is in a position to extract a normal domain name from your client app will probably be able to extract this random domain name just as easily, and they may not even bother with domain names and just get the IP address your client is connecting to anyway.
Emphatically speaking, that's useless. As was pointed out above, using some subdomain of your own would cost less, be saner, and have more utility.
If you have a number of nodes on a private network that is not physically private, use a good VPN system and machine authentication with certificates. If you do that, nothing is accessible except the Internet-facing VPN software, and that can easily ignore anything that's not legitimate.