Tag Info

New answers tagged

0

Why not look into stunnel? This will allow you to tunnel a protocol over HTTPS. You will need a public endpoint on your Linux box at home to listen on port 443 and then you can connect to what you need through that.


1

Nowadays, the Model-View-Controller Pattern has become much more than it originally was intented to be: Used for e.g. buttons in an application, the intent was to decouple the View from the Model and the Controller, making the button's design, behaviour and logic interchangeable, resulting in a more object-oriented, dynamic and modular design. Today it has ...


4

A three tier architecture does not necessarily mean that all the tiers are on different servers or even processes. It is more a thing that you abstract the parts of your application from each other that lets them interact only with clearly defined interfaces. In your case it means keeping the storage logic (database) separate from the business logic ...


1

Some core networking may be necessary for proper network configuration. If you disable DHCP, you won't be able to get an ip from the DHCP server (but you prevent getting an ip from an unlikely but possible rogue DHCP server) If you disable ICMP fragmentation, your network may not be as fast as possible (but you prevent someone unlikely but possible to abuse ...


2

You can use Wireshark to extract conversation statistics from the packet captures. This information can then be sorted through to determine which ports are used regularly: This screen is from the Wireshark Statistics->Conversations menu items. It also has a "Copy" button which will allow you to get this data as CSV; you could then extract destination ...


1

I don't know if i understand your question well enough, but to me this sounds like all you really want is to open the pcapng-file(s) in Wireshark. Maybe my answer is totally off the track. If this is the case, please specify your question further.


10

If nothing is listening on a port, no connection can be made to it, firewall or not. The same applies for desktop computers and servers. In theory, you're still safe without a firewall if nothing is listening and the TCP stack in the OS isn't vulnerable. We have the habit to use firewalls on desktops/servers because they are available and every layer of ...


1

Doesn't that mean that my phone is practically open for access by anyone? You are vulnerable to Wi-Fi eavesdropping but also to malicious applications you may run on your smartphone. By default smartphones do not come with Firewall, but in case you run lot of applications of which you are not very sure how much safe they are (say your kid is playing ...


1

The IDS is an Intrusion Detection System. An IPS is an Intrusion Prevention System. The IDS only monitors traffic. The IDS contains a database of known attack signatures. And it compares the inbound traffic against to the database. If an attack is detected then the IDS reports the attack. But it is then up to the administrator to take action. The major flaw ...


1

Truncated simply means that the packet was larger then the client expected. E.g. if the client expects only 512 bytes by doing recv(fd,buf,512,0) but the message is larger the recv will fail because the message does not fit. With the flag MSG_TRUNC the client can get the truncated message, but not the full message because it does not fit in the allocated ...


2

There are lots of ways to pass data through a firewall and more so if you don't have control of the software installed on the client computers inside the network. According to this information zenmate tunnels the data through a HTTPS connection. And according to this zenguard.biz is the backend server involved in this process. And based on this ...


0

The literal answer to your question is yes. It is possible to block the type of connections you mentioned. But in practice there is no foolproof way to prevent your networked windows machines from phoning home or taking remote instructions from Microsoft because, fundamentally, Microsoft - not you -owns your machines. Microsoft's abilities to see your data ...


1

As mentioned in comments, I think that ultimately you can't block all avenues an OS vendor may use to gather information from a machine, ultimately if you don't trust them the only avenue is to user a different OS. With that said there are some things you can do to try and reduce exposures for Windows 10 specifically. This script contains a good list of ...


2

You should read A Question of DNS Protocols by Geoff Huston, which is an actual investigation into this idea, with statistics and everything: If the DNS represents such a significant vulnerability for the Internet through these UDP-based reflection attacks, then does TCP represent a potential mitigation? Could we realistically contemplate moving ...


1

In this case, do I still need to create a rule to allow Network B to Network A on all ports, since there is TCP handshake? But how does it work? No, you do not need to do so because the traffic already took place in both directions. It is based on the stateful inspection principle (called also dynamic packet filtering) in which the stateful firewall ...


1

Connections are 2-way. Opening a port in a firewall allows a connection to be opened. Once opened it is 2-way.


-1

This actually is a vulnerability, based on your question. An open port on a firewall is a point of entry into a system. Having a service attached doesn't prevent it from not being a vulnerability. Even if you are referring to a OS firewall, the application of a firewall, and the actually application of software are two separate risk profiles even if they ...


6

...would that be considered a security vulnerability? No since there is no application behind that port to be exploited. (This port is actually called closed) Do not mix up an unfiltered port with an open port. A unfiltered port is just a port which has no specific configuration (rule) in a firewall. It can still be either open or closed.


3

A port is open when a service is listening to it. A service processes data. And that is why open ports are interesting for an attacker in that they expose the vulnerabilities of the services that are listening to (using) them. As long as there is no service listening to a given port we can not talk about open ports and the risks associated to them (by ...


0

The orthodox way to accomplish this would be to use SSL interception, such as SSLBump, with Squid. If you don't want to intercept SSL traffic, you can do this via DNS. This would have the effect of blocking the entire website regardless of protocol, e.g. http vs https vs ftp, based on DNS. So you could blacklist "facebook.com" and have your DNS server ...


0

When traffic is HTTPS, you can't see the full url visited by the user without doing a MiTM (sslbump). That's said, you can see the domain requested either by looking at the string after the "CONNECT" sent to your proxy by the client or by inspecting the beginning of the TLS handshake (thanks to the SNI extension). You can also block using DNS. You need ...


0

I am ruling out multicast traffic as the source IPs seem to be available in the ip databases. port 13766 is not a commonly used port, i could not find any software that uses this specific port. i really find it odd for someone to target this port. This is NOT a SYN flood because it was only 22 packets per second. a real SYN flood will use thousands/ sec. ...


0

iptables, as the name suggests, works at the Internet Protocol layer (OSI: network layer) and could drop any incoming packet. But there are some ways of "talking" to that OS at the lower, link layer: You can ask it for the MAC address and that might tell you something about the hardware and in turn software running it. A Samsung OUI is more likely to be a ...


1

OS fingerprinting, as you described, uses the network traffic characteristics of the OS. Some utilities exist to alter the defaults in order to mask the type of OS you use. Dropping all incoming packets would work against fingerprinting attempts made by initiating new traffic from the outside, but not against fingerprinting attempts made by the destinations ...


1

According to a blog post on 'Trusted BSD', a framework which OSX implements, a Mandatory Access Control (MAC) approach might work. The post seems to indicate that the system will require users attempting to access the resource (unprivileged and admin alike), to have certain associated security attributes. With this framework, there may be a way to prevent ...



Top 50 recent answers are included