New answers tagged

0

This is partly true. First of all, if you wish to go this way you need to understand that it's not enough to deny all incoming connections at certain times, you should deny them always. This is so because any time you are connected to the Internet (even if only for few seconds or minutes), you are potentially exposed to malware of all kinds. In fact, if you ...


6

No, that's simply wrong. Just like with a jail. They're not only built in a manner to keep anyone from escaping, but as well to prevent anyone from breaking in. You always have to think through both ways. Just an example: windows had a vulnerability that allowed arbitrary code-execution injected in JPGs (I think the format was JPG, but I'm not sure. ...


1

It's in the list file itself Peer Block works off of IP lists that you download and enable to block IP addresses on the list unless you allow them. This list also contains meta information in a format such as Label:XXX.XXX.XXX. They're really just .txt files generated by communities after they find someone you shouldn't connect too. Taken directly from a ...


1

Generally it is a good idea to disable bot NBNS and LLMNR. This is due to the fact that both protocols perform name resolution through either broadcast (NBNS) or multicast (LLMNR) which is not safe. For an attacker its possible to perform a MitM Attack using spoofed answers. When you have WPAD disabled there is a wider attack surface. WPAD is the Web Proxy ...


1

Probably to prevent NBNS-Spoofing. Anybody can answer NBNS requests and the requesting host will accept any answer. This enables MitM attacks. You're right that DNS provides the same service more securely and unless you have some legacy systems in your network, it should be safe to disable NetBIOS. In the worst case, having NBNS enabled can lead to a domain ...


2

It's highly recommended that you work with your network group to determine where to place Scanner Appliances in an enterprise network environment. Some things to consider: place Scanner Appliances as close to target machines as possible, and make sure to monitor and identify any bandwidth restricted segments or weak points in the network infrastructure. ...


0

I agree with Steffan that QUIC is no more dangerous than TCP or UDP or HTTP or any other communication protocol. I think for your use case what really matter is the data being transferred through the protocol. Like Steffan said, it really depends on the firewall and the concerns you are trying to address using that firewall. Doing an informal threat ...


1

QUIC by itself is no more dangerous than TCP, UDP, HTTP ... . What matters is the content transferred with the protocol. If you use your firewall only as a simple packet filter and don't do any content inspection (i.e. malware, URL filter etc) then it does not matter much if you allow QUIC or not. If instead your firewall is used to analyse HTTP(s) traffic ...


1

Yes, Please do it . It is still better than a network without any firewall. looking at the link, this is a simple network firewall with DHCP, DNS and SNORT. It does not decrypt your SSL traffic because it is not a Proxy. the Main function of this firewall is to protect your LAN from attacks (including some commonly known DDoS attacks as well). as far as I ...


10

If you router offers a real DMZ then the rest of the network would be safe even if your Windows PC is compromised. A real DMZ is a separate network which has no or only very restricted access to the internal network. But, what most SoHo routers call DMZ is actually an exposed host, i.e. traffic from outside is forwarded to a single host inside the internal ...


5

There are various ways that comes handy with nmap to evade the basic rules of firewall or Intrusion detection system. 1) Packet Fragmentation: This option evade pattern matching detection technique. Since packet reassembly can be quite processor intensive, it's common for admin to disable it. In snort, fragmentation reassembly functionality is disabled ...


1

Nmap has several useful options which can help you evade a firewall/IDS. The effectiveness of these options will depend upon what you are up against, i.e. the system(s) and how they are configured. A properly configured, modern firewall will hinder your scans very effectively. A good breakdown of the nmap options you can use can be found here. Generally ...


0

(IME) Java requires firewall exceptions for both TCP and UDP (and one firewall rule can't do both) so that's always two. In addition you can easily have/use more than one java programfile if you: use both java.exe for console mode and javaw.exe for GUI mode use both 32-bit and 64-bit java on 64-bit Windows use more than one major version (java 7 and java ...


6

SSL/TLS is a protocol providing an end-to-end encrypted communication between two parties each having one of the keys in private/public key pair. Typically a browser and a web server. In normal circumstances any device between the two endpoints cannot decrypt the communication. That includes firewalls. It is however possible (and used in organizations) to ...



Top 50 recent answers are included