New answers tagged

0

There are two ways on how to run an IDS: to detect attack attempts to detect successful attacks The mode is defined by the rules which are enabled. In most environments, like yours, there is no clear strategy which leads to having both kinds of events triggered. If you want to detect possibly successful attacks only (and ignoring attempts which are not ...


0

Answer No, this is not an indication for a compromise. Details about Portscans As the messages indicate, there are two different kinds of portscans happening: TCP Scan: Either a full (SYN, SYN/ACK, ACK) or half-open (SYN, SYN/ACK) scan FIN Scan: A more advanced scan technique It depends which threshold is required by the FW/IDS module to generate ...


0

Background I was looking into the source code of Chromium to determine if there is any blacklisting or filter possibility for history entries. I have checked the following files which are responsible for the whole history handling: history.cc history.h history_data.cc history_data.h history_data_observer.h history_data_store.cc history_data_store.h ...


3

The traditional term for this sort of device is WORM drive, where WORM stands for "Write Once, Read Many." A number of tape-like devices are still available and in use today. More modern equivalents are DVD-R, CD-R, and specially protected Flash drives. There are also vendors who have created magnetic (e.g., traditional disk drive) technologies which are ...


0

Use a DVD or CD. First use a marker to write something Unique on the DVD disc. Handwrtiting is the security step here. Then you could use a CLI tool to automatically burn to the disc. One could also use Multi-session disc burning.


2

All attributes can be seen here under "Permissions for files and folders" on Microsoft technet documentation: Permissions for files and folders The only attribute that is not there is the Full control which upon selecting will check all the rest of the attributes which is the detention of full control. Also, in the logs, event ID 4663 the Accesses ...


6

I recommend you to log user id and IP each time someone authenticate. That way, if a user post something, you know where it came from. Having a log like that is also useful for other purposes, like notifying the user in case you identify multiple IPs are connected at the same time, block consecutive attempts, etc. But for your specific example, I think you ...


0

It looks like you want to consider Data Loss Prevention tools (https://en.wikipedia.org/wiki/Data_loss_prevention_software). However before you go straight to the technology solution, you have to understand what "normal" file access looks like. If you do not know what that looks like it becomes impossible to know what abnormal looks like. This is ...


0

To address the DNS leak issue, I'm certain you can obtain the IP address of your VPN provider that you are making the connection to and firewall off all outgoing connections heading to any other IP address on any port other than the specific IP and port being used by your VPN. That will prevent any "leaked" traffic from exiting your network. Done. After ...


3

There are really two things you need to trust here: the DNS response's authenticity and privacy. Authenticity You can be reasonably sure of the authenticity of the data returned if all of the below are true: The site supports DNSSEC The site's TLD supports DNSSEC Your client checks DNSSEC - For a browser I recommend the extension at dnssec-validator.cz (...


4

You shouldn't trust them. You may suffer from "DNS Leaking". Ideally, your computer should send DNS Requests through the VPN, but it may request it directly. Your IP address will be exposed. Anyone snooping on the connection to the DNS Server will see what site you are accessing. That also opens you up to the dangerous Man-In-The-Middle attack. Use DNSCrypt. ...


2

While using your own VPN you can increase your security, putting the DNS server on the side of the network of the VPN service, and forcing any DNS request going through it through your own local DNS service/proxy. The ISP/DNS provider of the server/network where the DNS is hosted can however log, intercept and modify your DNS queries. Setting up a DNS ...


7

No, you can't. It's as easy as you search information about "DNS leak" topic. When you use a VPN, you have the risk of a DNS leak. In other words, your DNS resolution will be made outside your VPN. Second, VPN server knows (in some way) who you are, where are you from and where you want to go. It's the same risk that exit nodes of Tor Network pose. ...


2

This is a great question! I'm also a developer on a c++ product that handles high sensitivity data, and we face this dilemma almost every day. When a production system starts throwing alarms (especially performance or configuration-related ones, thought misbehaving software / bug ones also apply) we often need stack-trace level debugging turned on ...


1

I've been working as a penetration tester since the late 90's and have seen a lot of applications. It is not uncommon that once in a while an application logs user-identifying data. Most developers declare people having access to the logs as trusted and therefore don't limit the logging. If this might be an issue depends on the business case and the desired ...


3

You have no control over what the VPS is logging. They may be logging all communications, or none. There's no way for you to control it and no way for you to know what they are doing. The VPS provider is subject to all laws for its locale including search warrants. If you are looking for anonymity, consider Tor.


-2

If you are a technical person and also if you are security expert than you should not trust on any third party DNS. Because of there are so many websites and web-server , those are provides their services and also sell their data to another hackers for their profits. So If you have your own well prepared DNS and VPN then trust on yourself only.


-1

If you are using a VPN and that VPN is using a public DNS then your requests are most likely anonymous enough. The truth is that if they want to find you badly enough they will. Running your own DNS would be a bad idea as the requests being sent to a DNS with only one user would stand out as strange. I would say you should find the most popular DNS there ...



Top 50 recent answers are included