New answers tagged

0

A DNS entry to 127.0.0.1 is only helpful if the computer is inside a corporate network. In a home environment or at a public wireless site you have to rely on the browsers "Automatically detect proxy settings." If the browser has been re-installed or a new one installed the settings Proxy settings may still be turned on. To protect the system, put an entry ...


4

Changes to DNS aliases (CNAME) or IP addresses do not matter at all to certificate validation. All what matters is that the hostname as seen by the client (for example the name in the URL) matches the subject(s) of the certificate. This name will not change on any changes to the DNS. Often a DNS CNAME gets confused with a HTTP redirect. In the case of CNAME ...


2

Here are some useful tips from Kaspersky Lab’s team of Internet security experts: Be aware Public Wi-Fi is inherently insecure – so be cautious. Remember – any device could be at risk Laptops, smartphones, and tablets are all susceptible to the wireless security risks. Treat all Wi-Fi links with suspicion Don’t just assume that the Wi-Fi link ...


2

In a default configuration, all traffic (including DNS) should be routed through an OpenVPN tunnel. However OpenVPN in itself does not provide mechanisms to enforce all traffic being routed via its tunnel and if an application or the operating system decides to route traffic via unencrypted interface, it is free to do so (as was the case with Windows 10 ...


0

In simple terms, a DNS server has (at least) three areas of relevance if compromised: It converts domains to IP addresses, it may also act as a database/administrator for DNS administration, and it also has a generic role as a networked device. If DNS functionality or data can be compromised, then the effect would be that the attacker controls who you ...


0

hypothetically the best attack would be to poison the DNS server to redirect to a malicious site, worms then infect more and more. DNS exploitation would effect traffic and cause all certifications to be revoked. Also Cache poisoning, SYN flood attacks(floodguard would protect),DNS tunneling, DNS highjacking, and there are many others also as some companies ...


0

The security is security, no matter the network zone. Yes, there are not so much potential attacckers for LAN-only server, but it's not just leveraged, but hightened by the network speed : one lan attacker on strong/stable/guaranteed 1Gbps speed can try as many passwords, as 100 attackers from the WAN/WWW/Web with unstable connection speed, for example. Use ...


4

An attacker could try to bypass a hostname-based whitelist on your server. In a naive scenario, you might configure SSH or a firewall to only allow connections from "localhost", intending to lock out all remote machines for security reasons. A smart SSH server would recognize that 113.175.205.167 is remote and block the connection attempt. Eventually, it ...


2

From iBoss Knowledgebase on HTTPS Filtering: The iBoss blocks DNS outgoing requests which would block secure sites users are trying to connect to that fall under the iBoss filtering policies. If you are experiencing iBoss not filtering secure sites, try to flush the DNS cache by re-booting the computer and the iBoss unit. So yes, it sounds like ...


1

Generally it is a good idea to disable bot NBNS and LLMNR. This is due to the fact that both protocols perform name resolution through either broadcast (NBNS) or multicast (LLMNR) which is not safe. For an attacker its possible to perform a MitM Attack using spoofed answers. When you have WPAD disabled there is a wider attack surface. WPAD is the Web Proxy ...


1

Probably to prevent NBNS-Spoofing. Anybody can answer NBNS requests and the requesting host will accept any answer. This enables MitM attacks. You're right that DNS provides the same service more securely and unless you have some legacy systems in your network, it should be safe to disable NetBIOS. In the worst case, having NBNS enabled can lead to a domain ...


0

Finally, I got it! Dnsspoof can't modify DNS packet, it can only send another prepared packet with spoofed address. But the real packet comes to victim as first and victim's computer take into consideration only it. The solve our problem is blocking the real packet. I made this using iptables with specific address in hex: # iptables --append FORWARD ...


1

It depends on what you are trying to achieve. If you are trying to prevent DNS leaks, DNSCrypt isn't what you need. DNSCrypt is intended to prevent DNS spoofing, which is quite different. You could think of it as Privacy vs Man-in-the-Middle. DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS resolver. It prevents ...


3

Cloudflare is not primarily a DNS provider but a Content Delivery Network (CDN). The DNS functionality is only used to make sure that Cloudflare can give an IP address of their own CDN server when a client wants to access your site. And this way the client will access the CDN server which then will access your server to get the content and serve it to the ...


1

This could give rise to an information leakage vulnerability. Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources. For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique ...



Top 50 recent answers are included