Tag Info

Hot answers tagged

38

Is it possible to remotely connect to the Linksys device? Yes. Most routers have an online administrator page that can be accessed externally by visiting your public IP address (go check WhatIsMyIP.com too see yours). It's even easier internally by accessing the internal IP address of your router, which is in most cases either 192.168.0.1 or 192.168.1.1. ...


24

Blocking all ports except 80 and 443 can be part of a good defense in depth strategy. If it is your only strategy then you are correct, it will be a flawed one. A potential exampled layered approach may be Block all ports at the external firewall minus 80/443 Have an inline IPS (or as part of your firewall) do deep packet analysis Sanitize web-app input ...


16

Should you be concerned? Not if you weren't already concerned. Spare hardware is common. Giving it away to friends is common. Setting it up for them, if they don't know how to set it up themselves, is common. If you don't want to trust your neighbor, dig out the instructions and reconfigure the box yourself. Is it possible...? Depends, both on how the ...


14

You're absolutely correct. There's nothing magical about port 80, or port 443. There's nothing inherently secure about one port or another, or even one protocol or another. If you block everything but HTTP, everyone will simply start using HTTP. The attackers can and do always move faster than everything else. They aren't limited by maintaining old ...


13

Most things of importance placed in a data center have a sister installation in a physically separate data center, and if there was a reason to "fail over" from the live to the backup site, it's completely plausible that things like data shipping will occur as part of it. It also will result in a flurry of manual and semi-automatic administrative activity, ...


9

White-listing is generally preferable to black-listing. If you only open the ports you actually need, and if you limit those ports to the extent possible, then you've reduced your attack surface area and limited the traffic that you need to watch. Yes, 80 and 443 can still be abused for malicious traffic. But, you're also raising the bar for attacks (at ...


7

It is not difficult to set up a router, so you can easily reset the router to factory default settings and set it up yourself. Look at the back of the router and you'll probably see a small hole labeled "Reset". Stick a sharp pencil or straightened paper clip into the hole and press and hold for about 10 seconds. The router should reboot, and once it comes ...


4

A fire is a real threat in a datacenter, but it would certainly not be handled with an emergency data backup. Server Fault has some discussion about what to do in a fire; the consensus there was that as soon as it was identified as an actual fire, you press the emergency poweroff button and release the fire suppressant on your way out the door, and call the ...


3

A VPN or an anonymity network such as TOR can hide the details of your activity from your network's owner, although the fact that you are using TOR or a VPN is not hidden (and may in and of itself be considered suspicious activity). You need to be careful when setting this up, though, since mistakes such as DNS leakage (where your DNS queries go out over ...


3

In a WiFi network, all information which is sent over the network is broadcasted over the air. Usually network interfaces are configured to just ignore any network traffic not addressed to them, but there are tools available which change them to "promiscuous mode" which allows them to also log and show any traffic which they receive even though it is ...


3

See I want to ban the Tor network from my service from the official Tor documentation. The Tor project provides a list with IPs of all the exit nodes that can access your service, use query string parameters to tell it the IP and port of your service, example : https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=8.8.8.8&port=443. You can then ...


3

Without a defense in depth security strategy, once the perimeter defense of your network has been penetrated through your compromised server there are a few threats to the rest of your network. The vulnerability exploited by the attacker could be available on other machines on your network, allowing an attacker to move to another machine with ease. A poor ...


2

If you control the network, there really isn't an advantage (under almost any circumstances). What a VPN does is simulate having a leased line from your computer to the network the VPN server is on. If you are already on that network, there is literally no advantage (unless you enjoy encryption overhead). There is one main exception: if you control the ...


2

If you want a physical threat, you'd need something that would be a threat to data, but not people. Acid corroding the server stack, for example, might be better. Bob could trigger a backup in safety while racing against time to save what data he could before the server was irrecoverable.


2

In terms of browsing security/privacy, any time you are over http, your traffic could be (and often is, see cache discussion below) intercepted and fiddled with by servers along the way. Period. You can't be sure if the page you see over an http connection is in fact the page that the webserver sent in response to your web client's request. As far as ...


2

Yes, however, this is a common pattern. For example, this is how reddit's authentication works and Instagram's. Frankly, the only thing it protects against is sending your password over the network in plaintext. But the process does expose your session and all of your browsing data over HTTP, which just means your session has the same strength as HTTP. A ...


2

The thing about a VPN is that the connection between your computer and the VPN end point is encrypted. If you go to Joe's Coffee House and use their public WiFi, depending on the configuration it is possible that anyone in the range of your WiFi radio can snoop on your traffic. Even if Joe has secured his WiFi properly, anyone with access to the physical ...


2

The other address you are talking about is a MAC address, but that is only used at the local link level, not to communicate across the open internet. Only your IP address is used when talking across the internet, however there are other ways to track you. For one, the manual way is to contact whoever has the IP address and ask who was attached at the time. ...


2

You can be detected even using different network devices. If you connect from home using the Ethernet card, and on a Starbucks using the Wifi card, it's trivial to detect you. Now how: Cookies: The cookies on every site you access are independent of the IP address of your computer. So if you accessed Google from home, and accessed again from Starbucks, ...


2

This is a very long rant with many assumptions, hypothetical questions, and rhetorical questions, none of which play in to why this attack was 'traced' to DPRK. I would suggest cutting almost everything, and leaving your core question, 'How The Sony Hack Was Traced, and So Quickly?'. Everything else is filler and unnecessary to answer the question. ...


2

Port numbers don't matter. The applications that are listening or connecting on any port does matter. Use networking to limit application attack vectors. Some suggestions: Application nodes should be accessible on multiple networks with different purposes and traffic profiles : an application network and a management network. Avoid applications on ports ...


2

You could try doing this. Write a cron job that inserts a log entry at a certain start of the window. Monitor the file through some kind of file watching script. And at that point you correlate that with the http logs. The logs are in the common log format. http://ubuntuforums.org/showthread.php?t=866006 https://pypi.python.org/pypi/watchdog ...


1

By closing unnecessary ports you just decreased your attack surface, which is a good practice. But by running a modern operating system and web browser, you still have a relatively large (or should I say huge?) attack surface. For example, a secure up-to-date fully-patched drive-by-download-immune browser may not protect you from: Vulnerabilities in ...


1

Your key assumption is impossible. A "drive-by-download-immune browser" capable of surfing the modern web does not exist. Even if no known public vulnerabilities exist for a certain browser, there is always the possibility of zero-days. You don't download anything, but every time you visit a website with Javascript enabled, you are allowing arbitrary code ...


1

Computers (more precise: their network interfaces) have MAC addresses which isn't intended change (although they also can). It has a different format as the ip, and it is invisible outside of the providers network. State spying works otherway. Practically they use multilayer watching: there are their spy boxes by the network providers, there are by the big ...


1

You don't necessarily need two separate firewalls to accomplish this. Without seeing a diagram of your current network topology though, it's difficult to make recommendations. You mention two separate LANS. Are these logically or physically separated? You mention copying files onto a USB drive and moving the data to a machine on the other network. That ...


1

So what you're kind of describing is a DMZ or demilitarized zone. This is a common and widely accepted way for hosting quite a few different services. Such as Web Servers, Mail servers, FTP servers in a safe way. Essentially for your particular use case and from what you've suggested perhaps using a Dual Firewall architecture DMZ with an FTP server in it, ...


1

Barring unforeseen weaknesses in protocols or implementations of your VPN service, this should give you a reasonable expectation of privacy. All of your traffic that traverses the VPN will be encrypted from your system to the VPN provider. At that point it will travel normally. To your specific question of emails and login details, those should also be ...


1

There are a few more things you need to consider which may or may not effect what you desire to write. Firstly being is that real datacenters with SSAE16 certifications have in place controls and monitors which give a full accounting of all the goings on. Authentication and Authorization. When I go into my Tier 4 datacenter, I am required to use my ...


1

There's a lot of good general security practice information in the other answers, but as I've just been researching for myself the implementation of security in the HomePlug AV spec (used by the devices you mentioned, and many others), I thought I'd add a little more specific info not covered yet. First, there's no such thing as unencrypted data transfer ...



Only top voted, non community-wiki answers of a minimum length are eligible