Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've just taken over administering a lab of Apple computers on a university campus. We have about 15 computers and I've discovered that they all have public IPs and domain names. Even our printer is accessible from the Internet, which is probably the most terrifying.

I tried running a port scan on the computers in my lab using nmap but (obviously) I started lighting up computers all over the building and further afield. I'm not sure how to test our vulnerability without getting in trouble with network operations.

This situation makes me really nervous and I feel like I don't have full control over my cluster of machines.

I have two questions:

  1. Is it reasonable for me to be scared about the security situation in the lab?

  2. Is it reasonable for me to ask IT services for an explanation of the networking here and ways to mitigate my lab's exposure?

I'd feel much better with everything behind Tomato-based router and some port-forwarding rules rather than every single machine fully accessible to the Internet. I know that's not a silver bullet but it's better than nothing.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If you know the IPs of those computers, you should be able to scan just those IPs without hitting other nodes on your network.

When you say that you 'administer' the lab, that can mean many things, but I'll assume that you administer the machines themselves.

You have a legitimate concern for your machines. There should be no question about being able to talk to your IT services to get an explanation. It is possible, for instance, that your predecessor set up the network and IT services knows nothing about it. If IT services approves and signs off on the configuration, then they take the liability if anything goes wrong. You can work with them on ways to mitigate any problems.

On the other hand, I have seen private networks that use public IPs that aren't really public, i.e. they are not accessible to the outside. By using public IPs, they can play with route tables and make it difficult for hackers to tunnel in/out of the network. So, there might not be anything wrong, just 'non-standard'.

In any case, you should feel free to call IT services for a review.

share|improve this answer
    
Thanks! I think you're right that there could be some non-standard routing. I just need to inquire about if/how the network is NATed. My main concern is that protocols like SMB or AFP are unencrypted over a local network but it can be hard to tell how traffic is managed within the University network as opposed to from outside. –  Worried in Denver Jun 24 at 17:53
    
lol - marked as answer but no upvote. Oh well. –  schroeder Jun 24 at 17:54
    
Ah I haven't signed in. Hold on a sec... Long time lurker first time poster ;) –  Worried in Denver Jun 24 at 17:56

I think it's perfectly reasonable to be worried (I would be). Even if these machines have no vulnerable services now, your lab users are bound to install something dangerous sooner or later and chaos will ensue. For now, if nmap is overkill on your network, you can log onto each machine and run netstat to get a first glance at your attack surface.

You should definitely report this to your IT services and request some kind of NAT and / or firewalling.

If they do not want to act, though, keep in mind that you should refrain from remotely hacking that printer / vulnerable Mac to prove your point. Newspapers are filled with stories of sysadmins that got fired like that. Bite the bullet and keep a written track of your exchanges.

share|improve this answer
    
Thanks very much for your reply. I will definitely not be doing any hacking or even penetration testing. Netstat on each machine is a good idea. –  Worried in Denver Jun 24 at 17:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.