New answers tagged

0

When using IP Telephony you will have excessive use of UDP ports as this carries the voice packets. On Telephony systems you would typically define a range of UDP ports to be used. This range will also have QoS (Quality of Service) applied to them that will prioritize the UDP packets to have the least latency across a data network


1

First and foremost you can adopt a firewall policy of "allow what's needed, block the rest". That will only go so far because your malicious outgoing link may take advantage of a hole you have poked in the firewall. Enterprise grade products will "hook" certain functions like connect(). By hooking the function an analysis engine determines if the connection ...


1

I wrote a windows service a few years ago that monitors the event log for this, and firewall block IPs after a configurable number of failed attempts to authenticate over RDP. Details, download links (incl. source code) here: http://huagati.blogspot.com/2014/02/blocking-rdp-brute-force-logon-attacks.html


1

You should probably consider using the options in GPOs to restrict RDP to a specific set of known and trusted IPs.


5

I realize that this question has already been marked as answered, but Microsoft has a service included in Server 2008 R2 called Microsoft TS (or RDP) Gateway What this does is allow you to put another server (the Terminal Services Gateway) in front of your actual terminal server which listens on TCP 443 rather than 3389. In addition to cloaking the ...


8

Not exactly proven security, but Port Knocking can allow you to open up closed ports by sending a special set of packets to the server first. You could also rent out a cheap server with a dedicated IP address and set up a VPN, then explicitly set the firewall to only allow connections from the VPN IP.


7

Most of the RDP attacks are being targeted on standard 3389 port. Changing that port to any non-standard port like 8123 will make your remote desktop service listening to it. How-to-change-the-listening-port-for-Remote-Desktop Once you change it, you will need to specify the port number while initiating remote desktop connection. eg. IPaddress:8123


4

You may want to check out RDPGuard (Essentially fail2ban for rdp) and of course try your best to enforce a good password policy.


1

You'd be surprised how successful something like this can be - especially for a typical user who may not have any security controls in place. Also, I would argue that if you are able to convince a user to execute code you have provided, a malicious exploit is probably not even necessary - (i.e. "Microsoft Tech Support calls" that obtain remote access to ...


2

There are a number of ways that people attempt to mitigate these attacks. External Prevent spam filter from allowing MIME types frequently associated with malware (it's highly unlikely there is a business relevant reason to send .exe or .bat files for instance) Use Anti-Virus as .exe's can be detected even after several rounds of encoding. Preferably you'...


1

Beside asking the how you should consider asking the why. Case 1: you want to check how your service will be impacted by a DDoS -- this is possibly a reasonable thing to do. I would say that these are load tests taken to the extreme. In that case you need to test a clone of your whole service, including the infrastructure. You do not know what will fail ...


0

You can look the following questions about difficulties in generating your own DH key exhcange parameters and also using the standard DH group parameters: Is it safer to generate your own Diffie-Hellman primes or to use those defined in RFC 3526? and Where do I get prime numbers for Diffie-Hellman? Can I use them twice? For plain Diffie-Hellman, what you ...


0

The two-thirds number you refer to is specific to VPN servers using IPsec. I would wager to guess this is a result of Sys Admins and Security Individuals not taking the time to modify any more of the default settings in their server than they absolutely need to during configuration. Or, it very well could be an issue with the specific implementation of ...


1

It is generally assumed that your NAS is set for local access and not exposed to the external network via port forwarding or DMZ ... if this is not the case please update your question accordingly. Given this assumption, the NAS can be considered as vulnerable as the rest of your internal network. If you download a virus on a computer with access to the ...


3

A NAS is not necessarily connected to the Internet, e.g. my NAS has a local 192.168 address which is not routed. In addition I have blocked that IP address from getting Internet access through the DSL router. The NAS itself is protected via username and password. There are a few attack vectors, of course: the DSL router can be hacked. Getting root access ...


2

Fundamentally, the way a Distributed Denial of Service works is by flooding a companies bandwidth with to much traffic. The actual attacks may differ in source and style, but they share the same goal. There is no point in testing a DDoS attack, because no matter how much bandwidth you have it is always possible for it to be overwhelmed. It depends entirely ...


8

If you are performing load testing at high packet rates, the most safe way is to isolate it completely from the rest of the network. For example, you can connect two servers by direct 10GBps link without switch, and use another LAN connection on benchmarking server to ssh to one server to run the test. Another way is to provision servers in Public Cloud ...


5

The single best plan is not to do this. It rarely serves any purpose, as DDoS will work against you. That's a given. It is so easy to create a high volume attack now it's not even worth trying to do more than the usual load tests. You are much better served by implementing DDoS mitigation. If, however, you must test, try the following: test a non-...


0

That is incorrect. A hacker can exploit some vulnerabilities like SQL Injection, XSS, LFI, RFI, authentication bypass. He could bruteforce the FTP login or get access via SSH. Or maybe if you had a shared hosting, even if you don't have any vulnerability in your website, a hacker can exploit other websites on the same server and then he could use a ...


3

If usernames are listed and the same username can be used to authenticate, then this sounds like a user enumeration vulnerability. So if I want to attempt to gain access to the system, I can simply take the username list and then try a password list of the top 10,000,000 passwords against each username in turn, taking care to strip out those that do not ...


3

First of all, maybe the user doesn't want it to be publicly known that he is using the site. So it might not be a good idea to show this information without approval. To answer you question, in a normal situation, an attack should know the e-mail before trying to conduct a brute-force attack. If you give away all the e-mail addresses it will simplify the ...


14

The email and username are normally both considered to be public pieces of information so it shouldn't make much of a difference. Not having those pieces of information publicly available might slow down a hacker for the length of a Google search. If you're going to make it public, maybe just add an extra digit onto the minimum password length to compensate....


3

By having the username be shown publicly you are giving attackers another piece of the puzzle before they are launching the attack. For example: Assuming you can brute force Facebook, if Facebook showed some part of their users login information an attacker wanting to preform a brute force will just need to navigate to their victims page and get the login ...


3

One of possible answers is in the condition you noticed yourself: "this type of attack requires physical access at some point to install the malware". It doesn't require physical access at a later point in time. An attacker might have had the physical access before the data was created or stored on a target machine and exfiltrate the data later.


3

What I think is important to point out about malware targetting air-gapped systems is that as much as these methods require physical access, it doesn't require that the attacker himself has physical access. The idea is to spread the malware on as many computers as possible around the targeted system so that someone who is allowed to physically access it ...


1

I would be surprised if that kind of setup was ever used but the idea is that someone might install spying software on the machine which would broadcast the information obtained through fan speed modulation. The transmission rate of such an approach would be extremely slow as fan control is not designed for precision. It would require having equipment to ...


0

There are several ways of doing this. All of them are illegal (in the US at least). You can repeat traffic with a tiny bit of delay. You can make a nice device to do this out of a router and a Raspberry pi, in theory, but you should not. You can also just broadcast random noise, but echoes are worse. This is because random noise acts Gaussian, which ...



Top 50 recent answers are included