Hot answers tagged

44

Having all your corporate servers in the same network is a bad idea because if one of the servers is compromised, the attacker can easily spread out to the others. Servers are often configured to be secure on the front end, but when it comes to servers communicating with each other, there are various ways to find vulnerabilities. Also the sensitivity of data ...


43

I ignore them. And if you have a reasonable security posture, you should too. Your servers should have no ports open to the general public other than those that you use to serve the general public. For example, your web server should have open port 80, 443, and maybe 22; everything else should be SSH-tunneled or otherwise VPN'ed if you need to connect to ...


21

There is nothing wrong with running servers inside the corporate network - except that the corporate network should not be one wide, flat network. You should consider segregating assets and users into different "zones" and then write rules that allow the right (and expected) access between those zones. in your model, include "internet zone" and also any ...


18

I don't believe in enumerating badness. If you have infrastructure sitting on the internet it's going to get scanned all the time by numerous IPs. For example, I created an AWS app that turns up spot instances, scans blocks of IPs from a list, and turns them off once the results are shipped to the master server. If I was scanning your range daily you ...


5

Security is defined as the state of a system in which confidentiality, integrity and availability of data is granted. Privacy is the ability of a natural person to control the distribution of his or her personal information. If you are using for example a system of a big company - let's call it Oogle - it might be that their system is pretty secure, but ...


5

Servers usually need to be accessed from the Internet, so your network design must allow connections from the Internet to the network where your servers are. Now if you put the servers in the internal network, that means you have to expose the internal network to the Internet by design. And there is no reason to put the servers in the company network ...


4

Sure. Set up a SSH server with a weak root password, and leave it on the internet - within a few hours, you'll have been hacked. They will probably then upload a payload of some sort, but could just as easily pull the data from the machine with the existing software stack. Essentially, the key would be exploiting some form of authentication flaw, or dealing ...


3

I believe that you are asking if a side-channel can be used to extract information from encrypted communications without breaking the encryption. Specifically, can detecting the number of ongoing communication channels provide you with information? The answer is absolutely. Note that I don't know how UK police radios work or whether what you propose is ...


3

So in overall,which one should I prefer ? You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives. Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes ...


3

It's called a remote code execution vulnerability and Windows had several of these in the past which were exploited quite widely. A good example is the Win32.Blaster worm from 2003 which propagated automatically by exploiting a weakness in Windows DCOM RPC Interface. When the worm was released there already was a patch for the vulnerability available, but ...


3

I use Snort or Suricata on pfSense to automatically block IPs for a time period. Sophos UTM appears to have similar functionality.


2

Assuming that you control both the app and the server, the best strategy for preventing MiTM in mobile apps is to always require SSL and use certificate pinning. Certificate pinning forces your application to only accept a specific cert. This will prevent an MiTM even against an attacker who has obtained an illicit but valid cert for your site.


2

One way that an attacker can pull-off a MITM attack in a place where public wifi is available (like a hotel) it to create a fake wifi hotspot, which uplinks to the hotel's wifi. Then, the attacker can use a tool like sslsniff to intercept SSL connections. Edit: To protect against a MITM attack, the client should check that the server's certificate (or the ...


2

I agree with AdHominem that TCP/IP is a complex set of protocols. Based upon your self-ascribed "experience from curiosity", I think you would do great with a book titled Guide to TCP/IP from Cengage Learning. This is the current edition Amazon.com: "Guide to TCP/IP" Fourth Edition I have the third edition Amazon.com: "Guide to TCP/IP" Third Edition. I ...


2

Port mirroring, while possible even on cheap switches such as the Unmanaged Plus NETGEAR ProSAFE GS105Ev2 or the even better Easy Smart TP-LINK TL-SG108E, is a gamble due to timing and loss. It is very possible to configure a scenario where a long-term-running port mirror can continue to copy frames for months at a time without losing frames. You probably ...


2

Does this represent a security issue as I thought the two networks are separate and so should not be able to ping each other? Whether or not it is a security issue is up to you, but the router is behaving normally. Because the router is directly connected to both networks, it understands how to send traffic between them. To avoid this, you can ...


2

It's entirely possible to hack a system without malware, you can do this by taking advantage of vulnerabilities in applications/OSs or poor configurations. Some great examples (some historic) are: Default passwords: there are still routers on the internet with the default password cisco (or no password at all), or servers with system/system, root/toor, ...


1

After I see someone scanning I usually do a little recon on who they are, if they are on known blocklists I usually ignore and let the firewall drop it (ASAs). If they are an unknown entity I'll add a rule to drop connections with our IPS from that IP. I have used suricata in the past and will give that a +1 as it could help in a situation like this as the ...


1

The privacy of a system is all about making clear to the user how their information is going to be used and shared. That is, the amount of control an individual should be able to have and expect. The security of a system is ensuring that this expectation of privacy is met. That is, the mechanisms that can be put into place to provide this level of control.


1

The key difference is defense in depth (DiD) is a high-level concept. From the Wikipedia article: Defense in Depth (also known as Castle Approach) is an information assurance (IA) concept So it is much broader than a network security policy. The policy focuses on one aspect of security, the network. The policy also is a set of concrete requirements ...


1

Both will do what you need effectively. Whether you need to use one over the other depends on your use case. From what you have described, as long as there aren't other requirements, I'd go with TLS, as it requires very little additional work on most network architectures. IPSec is just a little more convoluted to set up - but it does provide additional ...


1

Agree with what Drewbenn commented. It appears that your account was opened in a significantly different geographical location. Netflix recently made changes to what type of traffic they will permit to stream. Without knowing more about where you opened your account and where you now reside it's difficult to pin that down as the problem. See below: ...


1

You should check whether your current IP is on a proxy list. Since your IP address is assigned dynamically, it could be that the former owner got himself onto a proxy list - these lists get generically blocked by many pages. It is, however, easier, just to get a new IP and try again.


1

It's possible there's some confusion here regarding your question. What do you mean by payload injection? Do you mean something that exploits a vulnerability and uses that to inject code? I'll start with the assumption that you mean injecting code. Payload Injection and you It's possible many people here are misunderstanding the term "payload." ...


1

TCP/IP is a complex topic and there are probably many answers to your question. For a beginner, after reading the respective Wikipedia articles (often an underrated source), I can recommend the CCNA Study Guide, they are not only taking Cisco hardware into account and it's a renowned institution. The CompTIA Network+ Deluxe Study Guide is much more in depth, ...


1

To elaborate more on Milen's answer, if you have no routing issues, then Transport mode is certainly feasible whether it's 2 gateways talking to each-other, or even 2 hosts talking to each-other (not doing IPsec). For example, if you had 2 public DMZ servers talking via Telnet over the Internet to each-other, and deeper in the network 2 IPsec routers were ...


1

You need to supply the proxy switch when using curl: $ curl --proxy [PROTOCOL://]HOST[:PORT] For system wide proxy usage: System preferences -> Network -> Proxies Please be aware that using Tor as a system wide proxy will most likely identify you as a person and is not a good idea if you want to be anonymous. When for example you start your ...


1

This is impossible without knowing the password (WPA prevents this). However, you can set up an open fake accesspoint and use a captive portal to get the password in clear text. This would require you to social engineer the target into connecting to your accesspoint. You can for example keep sending deauth requests to the real AP and let the captive portal ...


1

Using either the Windows (host) firewall or the guest OS firewall to do that is not recommended. All VM tools already provide that kind of control. Have a look at the different types of networking available. You want a host-only network. By design that can only be used between the host and the VM, it is never accessible outside the host. I should also have ...


1

You need to hide your GPS info. My browser asked me permission to use GPS location services in my Macbook Pro when I was entering the whatismyipaddress URL that you are visiting, and I denied it. So the site is asking for that. So it believes I am in California, USA. Otherwise with GPS, the scripts/site would find out my true location. It could be also ...



Only top voted, non community-wiki answers of a minimum length are eligible