Tag Info

New answers tagged

0

I perused the Microsoft TechNet article here: http://technet.microsoft.com/en-us/library/deploy_ipsec(v=ws.10).aspx (googled "windows firewall certificate authentication") and a little bit lower it says that it doesn't cover: Guidance for setting up certification authorities (CAs) to create certificates for certificate-based authentication. For this ...


1

There's actually a simple solution to this: build an application that takes a single command line parameter (the URL) and launches the browser directly with that URL after a confirmation box is shown. Set this application as the default browser. When the system sees a ShellExecute or CreateProcess with a http:// URI as the target, it passes off execution to ...


1

Place the virtual appliance in a secured VLAN, open ip any from the appliance to all IP addresses in the DC so we can ensure all UDP and TCP can be scanned. Give the virtual appliance a virtual interface for each VLAN in the data center Maybe I am missing something. Both your suggestions have you placing this in some form of internal IP Space ...


1

The question is which "view" you want on the network from the vulnerability scanner's Point of view. If you want to include the firewall security in your vulnerability assessment, you should Place the scanner with no access to internet, but on "WAN" side of security boundary in the firewall. Thus, your vulnerability scanner would then alert you if you ...


0

I have not seen anything pivot between the browser and the user that can inform them before the connection is made. Any add-on or application would take a serious beating processing so many variables. Let's have a look: Requester (via browser whether initiated or not) --> browser --> Go get this malice.com/bad.cgi How far do you think you'd be able ...


2

Question I have for you is, did you install it (RDMPlus) anywhere (your phone, work, etc)? Normally, with applications like this, when you connect, most applications are mere proxies between your two locations. For example, TeamViewer, whenever you install it, your logs will show what may appear to be strange connections to be interpreted. This is because ...


1

Another solution is to build or modify a existing browser, to not allow any type of external URL typing. You could even have it to use a screen keyboard or such to prevent malicious programs from using SendKeys(); and you could have scrambling screen keyboard and much other security features, And user confirmation if the browser is called externally with a ...


0

I would suggest this: Use a Proxy, which initially blocks all requests. For each blocked request, to authorize them, you would have to type a captcha or Another challenging factor that the malicious program will NOT be able to pass. If the captcha is passed, then the site in question will be permanently added to a whitelist allowing it to pass everytime. Of ...


1

"tcpwrapped" refers to tcpwrapper, a host-based network access control program on Unix and Linux. When Nmap labels something tcpwrapped, it means that the behavior of the port is consistent with one that is protected by tcpwrapper. Specifically, it means that a full TCP handshake was completed, but the remote host closed the connection without receiving any ...


0

https://www.enisa.europa.eu/activities/cert/support/chiht/tools/tcpd-tcpwrapper is a good quick article about tcpwrapped. Its probably a firewall that doesn't like your IP so ita just dropping your conection. Unless you can figure out what IPs it likes or trick it into thinking your a LAN IP (I dont know if that is possible tbh) then I don't think you can ...


1

The word "firewall" just describes some device or software to separate security zones. It is not a description of a specific technical implementation. Implementation range from simple packet filters like iptables at OSI layer 3..4 up to application level gateways at OSI layer 7. (Application) proxies instead refer to forwarding a protocol at the application ...


2

A normal firewall typically works on Layer 3 and 4 of OSI model, a proxy can work on Layer 7. Also another thing that a proxy does is: anonymise the requests. E.g.: A normal firewall can block based on destination / origin IP or TCP/UDP ports. A proxy can block based on protocol (https) and / or url (http://stackexchange.com)... Now most of the modern ...


3

I would recommend doing a little reading on the OSI model. It might help shed a little light on this, but I will give you a brief overview so this makes more sense. Remember that these concepts can blend together and a firewall could have all of these features. A traditional network firewall operates at layer 3 and layer 4 of the OSI model, which is IP ...


0

In your case I would recomend a VPN server. This appears to be a very secure site, and you hardened the server side very well. Using a VPN infrastructure will put another barrier between the server and the attacks. If you already have the users receiving and entering the authorization code, they will be able to connect to a VPN without much trouble. In my ...


0

It does work by either having a meta refresh, or a JavaScript, that continually send request to hold your session alive. Basically, it works by having a session identifier, that is a random string. This session identifier might be valid for lets say 3 minutes. Each minute, that webpage will either execute JavaScript code, or do a meta refresh, causing the ...


0

To your initial question, the only thing I've seen that purports to really do this is the Gartner Magic Quadrant. However, given the overall complexity of firewall solutions, it's hard to make an apples to apples comparison in my opinion. Often they are used for their basic layer 3 and layer 4 filtering capabilities, and as such are treated like commodity ...


0

Firewall, IDS and IPS are not the same creatures. And as stated, defense in depth is the thing you're looking to provide. A Firewall is a control mechanism used to restrict the protocols traversing between two networks at layers 3 and 4 - that is its primary function (See Shane's answer). In some instances, the firewall can perform limited inspection of ...


5

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat Management) which are firewalls with IPS/IDS services integrated as a subscription. Firewalls serve to control the inbound/outbound connections into an ...


0

Defense in depth Presumably, your firewall will be letting some traffic in and out. Otherwise, just disconnect from the network and you'll have a lot less to worry about. Once traffic comes in to your network past the firewall, it would be prudent to be keeping an eye on it to make sure it isn't malicious. Unless your firewall rules are perfect, you are ...


1

It's certainly possible to block based on more sophisticated protocol detection than simply the port. It's also quite possible that the traffic is being broken by accident. Domestic Internet providers will often assume that their users are doing conventional things and optimise their networks accordingly. One useful test would be to establish a VPN from ...


0

This entry also specify that this machine is trying to establish a TCP connection to port 5222 on the remote system. TCP 5222 is, usually, XMPP (Jabber). The next step is typically to go on the machine and find out which application is trying to open that connection and if it's legitimate or not. How you do that depends entirely on the operating system you ...


1

To put this a little more officially as an answer, I believe OSSEC has the options you're looking for. You can create custom rules, configure it to watch specific log files (such as your web server logs), and trigger alarms if certain regex matches or strings are detected. Active response can actually run more or less any command, you just have to place it ...


0

http://www.lowth.com/howto/iptables-treasures.php And what a treasure it is. IPTables itself has a string module that can do this by looking for strings defined in the ruleset and passing them on. http://linux.blogs.com.np/2008/03/11/iptables-string-matching/ Kernels from 2.6 include support for matching strings present in IP packets, inspecting the ...


0

Shellshock has been exciting today! To answer your question: Normal PAN-OS maintenance release updates will provide a fix for the vulnerability. I'd always recommend their wildfire professional subscription on the perimeter, it has worked well for my organization! But you don't really need it, Palo Alto Networks released an emergency IPS signature for ...


3

That is what VirtualBox's host-only networking mode is for. It creates a virtual network adaptor on the host and connects it to a virtual network adaptor in the guest. Then you just tell the services running on the host to only listen on the virtual adaptor. See section 6.7 of the VirtualBox manual for more details.



Top 50 recent answers are included