The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
1answer
58 views

What use are systems that ban IP addresses if all the evildoers spoof them anyways

Many anti-spam or web applications with a security component give the ability to ban IP addresses. In my experience any bot, person or other entity that is truly nefarious is using an endless supply ...
1
vote
1answer
167 views

Any way to block IP address host header spoofing?

I have already added the following the following to my nginx config to deal with spoofed domains: if ($host !~* ^(.*example.org|\d+\.\d+\.\d+\.\d+)$ ) { return 444; } Right now ...
0
votes
0answers
53 views

How To Stop Cisco ASA Spoof Attack

I have thousands of "Deny TCP reverse path check from 10.60.60.X to 10.60.6X.X on interface outside" The IP addresses for the source and destination hosts are all over the board, and the interface is ...
0
votes
1answer
78 views

Brute force attacks with server's IP

I am running a Debian wheezy server with fail2ban installed, everything works as expected but recently my own server got banned. I added the server's IP in the exception row and it seems to work, but ...
1
vote
2answers
161 views

Wrong DNS answer with CNAME and A Record at the same time

We had a customer which has set a CNAME Record for his domain. Somehow he managed it to set an A Record too, which should be not possible and is forbidden by DNS. But the result was: $ dig ...
2
votes
1answer
114 views

Does postfix reject spoofed senders?

Is there a reliable way to reject incoming mails with a spoofed e-mail address? What kind of checks does postfix run normally on incoming mails? does postfix check the reverse dns by default? does ...
0
votes
1answer
24 views

how to discourage email spoofing

One of my production server emails look like to be spoofed from another network. The team (group or individual or professional company) is sending mass mails out to their list of users, using our ...
-2
votes
1answer
86 views

Security against IP spoofing without consulting network administrator [duplicate]

I was wondering that if there is a Local Area Network and one public IP,through which various clients connect(which have been allocated private IP's).Suppose one of the clients spoofs his IP to try to ...
1
vote
1answer
271 views

Practical way to implement prevention of IP Spoofing

I am an undergraduate Computer Science student and was hoping to gain some knowledge of ways to help prevent IP spoofing but all the resources I have tried out elaborate this concept in a theoretical ...
1
vote
1answer
659 views

Exchange 2010 email spoofing prevention

Masters, Unfortunately we got some spam mail which seems to be coming from our own domain. I found some article which all says to remove Anonymous login from internet receive connector ...
0
votes
2answers
219 views

Protecting my Bind dns server from slow kaminsky-style cache poisoning attacks

Dan Kaminsky described how DNS servers could be poisoned with spoofed DNS responses [1]. As I understand it, the problem was that Kaminsky found a way to account for most other sources of randomness ...
0
votes
1answer
67 views

DNS request anomaly

Experts, i have some problem in DNS servers configuration, network diagram is shown in figure: The problem is manifesting as follows: There're 2 DNS servers servicing both internal and external ...
1
vote
0answers
360 views

Woes with named/bind and forwarding zones

I'm sadly restricted to a very old version of bind (9.4.2) This is the think. If I setup bind with a named.conf and only forwarding it works perfect. acl clients { any ; }; options { ...
0
votes
2answers
124 views

How to spoof an IP for application that needs this particular IP?

In general, such a problem, there is a system RHEL 6.4 Server with a pair of network interfaces combined into one by bonding. This system IP address: 10.7.7.1. Next on the system running an ...
0
votes
2answers
132 views

Spoofing NS records for pre-transfer DNS testing

I'm about to transfer a domain from one registrar and DNS provider to another, and I want to test the new DNS host before starting the transfer. The new host provides plain DNS service beforehand, so ...
1
vote
2answers
176 views

Spoof database connection to be local instead of remote

I am trying to connect one of our clients "as is" programs to a remote database instead of a local one, they think that they have coded it to work that way, but for some reason the program crashes ...
1
vote
1answer
121 views

Bingbot spoof localhost ip

So here is a fun one. I'm getting bingbot requests at a certain time everyday that kill the server. Here is the request: 127.0.0.1 - - [14/Sep/2013:08:18:49 -0500] "GET / HTTP/1.1" 200 82810 "-" ...
0
votes
1answer
38 views

Should I move servers and change email address after email spoofing? [duplicate]

I'm hoping the community can help me shed some light on a recent email spoof. Yesterday my client woke up to find hundreds of bounced failure notices. The client did not personally send any of these ...
1
vote
1answer
298 views

“From:” e-mail header spoofing - how to verify such mail?

I'm facing a problem of verifying a "From:" message field in e-mail messages, in terms of e-mail spoofing. I am currently using SPF and DKIM to verify the origin and integrity of messages, but as far ...
2
votes
2answers
108 views

If I use iptables to allow TCP connections only from a specific IP, can it be faked?

An iptables rule on my database server is: -A INPUT -p tcp --dport 6432 -s 10.115.0.150 -j ACCEPT I have other rules (loopback, etc.), but I'm wondering if that specific rule can be "hacked". Can ...
0
votes
1answer
210 views

Counter MAC Spoofing with Cisco

I was wondering if someone could help me with the needed cisco commands to configure a switch to only allow certain mac addresses on certain ports. So that one mac adres can only connect to the ...
0
votes
1answer
302 views

Tracking anonymous e-mail threat

A user spoofed/sent an email from http://emkei.cz/ with a very serious threat. Is it possible to trace this back or are we SOL? There wasn't much in the email headers other than that it came from ...
0
votes
1answer
317 views

Can a machine(physical or virtual) accept and process UDP packets with a different IP address coming from a known device?

Before everything, thanks for reading the next question. I have script,(ipUDPspoof.rb), which is a client/server script in Ruby (you choose the parameter 1 to be server and 0 to be client, at ...
0
votes
2answers
154 views

SSH:using single public key on multiple remote machines and spoofing-by-known-server

Lyrics Usually, people say, that using single public key on several servers is just as secure as using unique public keys on each of them. (If we're not talking about possibility of private key being ...
0
votes
2answers
2k views

oidentd properly configured yet not properly working on CentOS 6

I've been experiencing this problem with oidentd for a couple of days and I can't seem to be able to find a solution to this yet. oidentd seems to give me headaches every time I want to get it work on ...
1
vote
1answer
198 views

Finding spoofed IP address on network

I have a few IP spoof dropped messages coming out of my Sonicwall firewall, we'll call them Source A and Source B. Both of these sources have the same mac address indicating they're coming from the ...
0
votes
3answers
1k views

Exchange and SPF Records

I've created an SPF record on 123-Reg, which is working great. But my question is how Exchange servers know that an SPF record exists when they receive mail from a domain. How does Exchange know it ...
2
votes
1answer
685 views

Prevent mail server (sendmail) used to backscatter

Hi I recently got an email from Amazon, saying that my EC2 instance is sending spam. So what they say is my mail server is receiving email for a non-existing user and therefore bounces the email back ...
3
votes
1answer
467 views

How did this email bypass my SPF settings?

I received a phishing email this morning that appeared to come from one of my addresses to itself. Looking at the headers, I found something interesting. DomainKey-Status: no signature ...
3
votes
3answers
244 views

How to Limit the Damage of Domain Spoofing

My e-mail account, for my privately run business which I'll call "VeryCoolCompany", is starting to receive bounce-backs for users who don't exist, like these: alan12ab1@verycoolcompany.com ...
6
votes
5answers
574 views

Any way I can correct DNS spoofing against our domain

This morning I found out that our domain and subdomains have been poisoned on the 4.2.2 and 4.2.2.1 DNS servers along with others I think, though I have not confirmed others yet. Using OpenDNS ...
1
vote
2answers
3k views

ISP login, MAC spoofing, WiFi and multiple devices

I have a Tikona Digital Broadband (WiMax based) Internet Connection which allows limited number of devices to be connected at a time and also requires that the users login with username and password ...
3
votes
6answers
2k views

How reliable are IP address-based firewall restrictions?

On some of my production systems that need to be accessible outside of the LAN I will sometimes add a firewall restriction at the edge to only permit traffic on, say, RDP from a specific origin IP ...
1
vote
2answers
2k views

Different Mac address to virtual interface and primary interface

I am developing a system, where I need virtual interface to have different mac address for my primary and virtual interface lets say my mac for eth0 is 00:11:00:11:00:11 and my virtual interface is ...
1
vote
1answer
991 views

When a client sends a RST packet, will the server close the connection ?

What I'm trying to do is block RST attacks with IPTables. When I do a search for it, I'm seeing rules where packets with the RST flag set is being rate limited. I'm questioning it a little bit. I ...
13
votes
4answers
14k views

Can the IP address for an HTTP request be spoofed?

On a website I am building, I plan to log the IP addresses of submissions, just in case it's necessary. I don't mind proxies, but outright spoofing your IP address would defeat the purpose. To ...
1
vote
1answer
335 views

DDoS false IP attack [duplicate]

Possible Duplicate: DDoS attack, how to stop? I'm getting 10MB attacks, IP spoofing, which is used fake IPs, causing high CPU usage of the machine, and falls all. What should I do to ...
0
votes
1answer
190 views

iptables: is it possible to spoof NEW packets and make them look like ESTABLISHED packets?

See title for the question. This question relates to a previous question wherein I asked the difference between NEW,ESTABLISHED and RELATED , see it here iptables: difference between NEW, ESTABLISHED ...
-2
votes
1answer
474 views

Can an attacker exploit the vulnerability of the firewall to access the www server?

What happens if an attacker has found a technique for sending packets through the firewall to the DMZ without the packets being checked? Suppose the attacker doesn't know the internal addresses of ...
7
votes
1answer
2k views

How to prevent IP spoofing using MAC and ebtables?

I am trying to create IP-MAC pairing rules in ebtables. There are few tutorials and related questions [1] available but I have kind of specific setting. ENVIRONMENT: I have many physical hosts. Each ...
0
votes
1answer
205 views

Cisco 871 IOS BVI: Distinguishing incoming and outgoing

I understand that a BVI is very much equivalent to a network switch. But it includes the benefit of being able to have an access control list. I am doing this, but I would like to more effectively ...
0
votes
1answer
229 views

Blocking External Mail Sent w/ Spoofed Email Address

We recently got an email from an outside server that had a spoofed "From:" header that was the email address of one of our users. Is there a way to have sendmail reject emails coming in from an ...
-5
votes
4answers
91 views

Hiding Gaming Software's Main Server [closed]

I run a gaming website. Players download the client software, install it and run it on their desktops. The software isn't hosted on the main server but I have been told that once the software is ...
0
votes
2answers
263 views

Hyper-V MAC Spoofing security hole

I have a windows 2008 R2 SP1 standard dedicated server and i installed Hyper-V role on it. I'm serving Hyper-V VPSs on this server and i can't trust virtual nodes. now the broblem is each node can ...
0
votes
1answer
305 views

Banner Grabbing Spoofing

I run a windows server 2008 standard R2. Is there a way to spoof the server banner ? So instead of Microsoft-IIS/7.5 it could be anything.
1
vote
1answer
792 views

Linux-KVM / iptables: prevent guest spoofing by matching ip+mac address on bridge?

I have my KVM guests on a standard br0 bridge setup: auto br0 iface br0 inet static address 192.168.1.117 netmask 255.255.255.0 network 192.168.1.1 broadcast 192.168.1.225 gateway ...
0
votes
2answers
292 views

My exchange 2003 mail server is blocked by RBL lists. Someone is sending spam from inform@mydomain.com

All outgoing email to external recipients from my Exchange 2003 server is getting blocked by RBL lists. I'm new to administrating Exchange and i checked the Message Tracking Center under System ...
0
votes
1answer
623 views

What's the best way to block IP spoofing on a layer 3 switch?

We're hosting Dedicated Servers and are currently using old 3com switches with IP-based ACLs. So each port has an ACL that allows all IP addresses assigned to this customer, and blocks everything ...
1
vote
1answer
748 views

Using arpwatch to backtrack proxy access ip to eap-tls certificate

In my network I am using eap-tls authentication (machine certificates) for clients. Those clients are using a squid proxy to access the internet. The proxy is logging the request to the access.log. ...
1
vote
2answers
201 views

MAC spoofing - keeping the connection alive

Is it possible to keep a connection alive, while spoofing/changing the MAC address of your own network adapter (especially wlan adapter), without needing to re-authenticate against 802.1X ...