Tag Info

Hot answers tagged

11

If nothing is listening on a port, no connection can be made to it, firewall or not. The same applies for desktop computers and servers. In theory, you're still safe without a firewall if nothing is listening and the TCP stack in the OS isn't vulnerable. We have the habit to use firewalls on desktops/servers because they are available and every layer of ...


6

...would that be considered a security vulnerability? No since there is no application behind that port to be exploited. (This port is actually called closed) Do not mix up an unfiltered port with an open port. A unfiltered port is just a port which has no specific configuration (rule) in a firewall. It can still be either open or closed.


4

A three tier architecture does not necessarily mean that all the tiers are on different servers or even processes. It is more a thing that you abstract the parts of your application from each other that lets them interact only with clearly defined interfaces. In your case it means keeping the storage logic (database) separate from the business logic ...


3

A port is open when a service is listening to it. A service processes data. And that is why open ports are interesting for an attacker in that they expose the vulnerabilities of the services that are listening to (using) them. As long as there is no service listening to a given port we can not talk about open ports and the risks associated to them (by ...


2

You should read A Question of DNS Protocols by Geoff Huston, which is an actual investigation into this idea, with statistics and everything: If the DNS represents such a significant vulnerability for the Internet through these UDP-based reflection attacks, then does TCP represent a potential mitigation? Could we realistically contemplate moving ...


2

There are lots of ways to pass data through a firewall and more so if you don't have control of the software installed on the client computers inside the network. According to this information zenmate tunnels the data through a HTTPS connection. And according to this zenguard.biz is the backend server involved in this process. And based on this ...


2

You can use Wireshark to extract conversation statistics from the packet captures. This information can then be sorted through to determine which ports are used regularly: This screen is from the Wireshark Statistics->Conversations menu items. It also has a "Copy" button which will allow you to get this data as CSV; you could then extract destination ...


1

Getting a job in infosec working with a company like HP is a big opportunity. HP are about to split into two organisations, HP ink and Hewlett Packard Enterprise (HPE). HPE are making a massive push into security and want to be taking on the likes of Dell SecureWorks and Deloitte in the next few years, so as far as security goes they are a good company to be ...


1

More Dates Data ... svchost.exe when it tried to access DataDefinitions at Norton's install folder. It seems a very clear activity of a trojan, doesn't it? svchost is a process which is used for lots of different things. So it might be an infection or it might be not. And it is not even clear that the infection happened only after Norton got installed. ...


1

Nowadays, the Model-View-Controller Pattern has become much more than it originally was intented to be: Used for e.g. buttons in an application, the intent was to decouple the View from the Model and the Controller, making the button's design, behaviour and logic interchangeable, resulting in a more object-oriented, dynamic and modular design. Today it has ...


1

Some core networking may be necessary for proper network configuration. If you disable DHCP, you won't be able to get an ip from the DHCP server (but you prevent getting an ip from an unlikely but possible rogue DHCP server) If you disable ICMP fragmentation, your network may not be as fast as possible (but you prevent someone unlikely but possible to abuse ...


1

I don't know if i understand your question well enough, but to me this sounds like all you really want is to open the pcapng-file(s) in Wireshark. Maybe my answer is totally off the track. If this is the case, please specify your question further.


1

As mentioned in comments, I think that ultimately you can't block all avenues an OS vendor may use to gather information from a machine, ultimately if you don't trust them the only avenue is to user a different OS. With that said there are some things you can do to try and reduce exposures for Windows 10 specifically. This script contains a good list of ...


1

Doesn't that mean that my phone is practically open for access by anyone? You are vulnerable to Wi-Fi eavesdropping but also to malicious applications you may run on your smartphone. By default smartphones do not come with Firewall, but in case you run lot of applications of which you are not very sure how much safe they are (say your kid is playing ...


1

The IDS is an Intrusion Detection System. An IPS is an Intrusion Prevention System. The IDS only monitors traffic. The IDS contains a database of known attack signatures. And it compares the inbound traffic against to the database. If an attack is detected then the IDS reports the attack. But it is then up to the administrator to take action. The major flaw ...


1

Truncated simply means that the packet was larger then the client expected. E.g. if the client expects only 512 bytes by doing recv(fd,buf,512,0) but the message is larger the recv will fail because the message does not fit. With the flag MSG_TRUNC the client can get the truncated message, but not the full message because it does not fit in the allocated ...


1

In this case, do I still need to create a rule to allow Network B to Network A on all ports, since there is TCP handshake? But how does it work? No, you do not need to do so because the traffic already took place in both directions. It is based on the stateful inspection principle (called also dynamic packet filtering) in which the stateful firewall ...


1

Connections are 2-way. Opening a port in a firewall allows a connection to be opened. Once opened it is 2-way.


1

OS fingerprinting, as you described, uses the network traffic characteristics of the OS. Some utilities exist to alter the defaults in order to mask the type of OS you use. Dropping all incoming packets would work against fingerprinting attempts made by initiating new traffic from the outside, but not against fingerprinting attempts made by the destinations ...



Only top voted, non community-wiki answers of a minimum length are eligible