New answers tagged network
0
Neither a shared filesystem nor SSH satisfy the Principle of Least Privilege, so neither is "secure" solution.
Instead, the best way is to set up an access mechanism that grants file access to the specified files (and no others) to a properly-credentialed request. Those credentials should ONLY be useful for obtaining the necessary files.
A simple example ...
0
My answer will include quotes from others who have answered.
1) As answered, depends on the skill level of the attacker. However, you should treat an attacker as an attacker period. Whether they are attacking via a wireless network, or sending you a client side attack.
On the client side attack, the compromised machine thereby becomes the attacker.
2) ...
0
You could do this with a SAN on a second NIC on the outside server. You would need to make sure that the rights for the share were very strict though.
Additionally (if there is not a need for extended services) rather than using DMZ you can move the outside server behind the firewall and use NAT to map the traffic to the now outside server. Then restrict ...
1
When you state "share" I am envisioning an xml file that is written on one server (backend), given to the other (frontend) where someone can read, download it. Did you mean a specific file that is shared (written, opened) by both symmetrically?
E.g.: you have an application that needs to apply xml values for a visitor:
Webserver --> Display content (use ...
0
Multi-function printers have reasonable computing power, and many are in fact linux devices, so it is theoretically possible that someone could use it to bridge into a network. It would make little sense to try it though:
Slow access: most faxing happens at 9600 baud, that's really slow. Even if you could negotiate faster the best you could realistically ...
0
I haven't run across any exploits for such interfaces, no.
When you write "incoming FAX lines", are these IP connected or classic E1s?
There has been some cases of people exploiting FAX software/machines before, but I don't believe those exploits have been made public (besides those windows software solutions..)
In any case you'd need to figure out what ...
1
1) Depends on how your computer is setup and how observant you are. It shouldn't be obvious if they are competent, but little things like unexpected CPU and Hard drive usage are not really something that they can easily prevent from being visible. There are normal activities that can cause random CPU and HDD activity, but an attempt at hacking would have ...
0
1) Probably not considering the questions you ask :)
2) Depends what you mean by "permanently deleted", but I believe the answer is "yes" - see 1.
3) Low
4) Yes
I believe somebody can spend and hour writing up an answer to your questions as they are very broad and you give no specific information.
1
If he's doing something to my laptop, will I notice?
Probably not if the hacker is in any way competent.
Hackers can copy data stored on my laptop, but can they possibly retrieve permanently deleted files? (empty recycle bin type of delete or shift + delete)
There is always a possibility. "Permanently deleted" files aren't really deleted. Traces ...
0
This does not seem to show evidence of a botnet to me. Is router2 using NAT? If so, it is going to take the requests from clients, re-map them to one of the ports on it's own WAN IP (the 172.11.19.102) and make the request to the original destination (Google). Router1 would then resolve the external IP and forward the packet along the appropriate channel ...
4
If it is truly unsecured wireless, then a simple packet sniffer should pick information on the wireless network out of the air though you may have to use special drivers if your wireless card normally only presents information that is being sent to your MAC address. Most passwords would still be secure though as they should be getting exchanged using secure ...
5
There are different ways of tackling this:
Disable unused ports (which should obviusly be the first line of defense)
Using port security on your switch makes it at least necessary that an attacker finds out a certain MAC address and connects to a specific port, which will stop most people from plugging their home devices into the company network. In ...
0
NAP would be your best bet and is available for Linux and Mac clients. You can also "register" devices that do not have NAP capability manually or mostly automated with a portal page. Either way, you should, as others have pointed out, work on your physical security if users are able to freely unplug machines.
0
Just disable unused ports on the switch, on this way if the attacker plugs in a cable it won't connect to the intranet because that port was disabled.
Obviously, if he unplugs some device and plugs its device there, he can connect to the intranet. But in this point get in the game another question, how is your physical security?
0
Ideal setup is to treat employees differently and the outsiders who come to office differently.All the employees should be put on a different network in a different firewall zone say trust(10.2.0.0/16) and the outsiders on another network on another firewall zone say trust2 (10.3.0.0/16)
You can provide access to the internet from trust and then whitelist ...
2
Have you thought about setting up honeypots on your network as well? They are pretty good at being able to configure ect.
http://en.wikipedia.org/wiki/Honeypot_(computing)
I have also used a few programs for VMs.
Virtual box is one of the most common free ones (windows box).
Proxmox is really common freeware that provides a lot of flexibility with ...
7
So if I was you I would start relatively simply with some VMs and a host machine.
Personally I use VMWare workstation but other virtualization products are possibilities.
If you've got a decent enough machine (e.g. 8GB RAM, Quad-Core Sandy/Ivy bridge, fast disks), I'd recommend keeping the Host OS clear of lab tools or target Apps, as re-building VMs is an ...
1
Your iptables rules look generally fine to me, although I cannot spot how you are enforcing 22 from the VPN only (unless you have configured sshd to only listen on the VPN IP, which should be ok).
Also you can use POLICY (-P) rather than your bottom two rules, but either should be fine.
0
I have a Buffalo Linkstation Pro and with the latest firmware it comes the option that supports AFS file system that is encrypted. That will ensure communications between your PC and NAS are encrypted.
SMB should support NTLMv2 in windows for communications which is encrypted too.
The issue to manage the storage itself to be encrypted it will drive you ...
2
Yes and no.
Yes it can be traced to your ISP, ergo to the geographical area in which your ISP exists. This is more often that not where you live. But no, it can't be easily and directly traced to you.
It is required by law to provide correct information when reserving Internet resources (domain names, IP addresses), those information are stored in a ...
5
When teamviewer is installed it includes a daemon that runs under the system account. The client that is started under the users account only provides instructions to this daemon.
As this service already has elevated rights assigned at the time of installation (the creation of this daemon) it is possible to directly emulate key strokes as coming from the ...
0
I have run screen on bastion hosts in the past but have been trying to get away from it for just the reason you mention. If the bastion host is intruded upon they can get access to all of your open sessions. So running screen/tmux on a bastion host is NOT recommended.
2
Since both tmux and wemux use their own server-like process and joining/authentication procedures, they inherently increase the so-called "attack surface": that's more code which may have bugs, and bugs can easily become vulnerabilities.
However, at least tmux has good repute, with, as far as this page says, was only ever affected by one known ...
1
You need to be aware of (at least) the following:
If your documents are in a publicly-accessible folder, they're not private. This includes simple protections such as checking the referer, which are trivial to juke
If your documents are in a folder above the HTTP root, it is one step better; if they're encrypted and only one script can read them, even ...
1
From a strict cryptographic point of view, they both provide authenticated encryption, but in two different ways.
SSH uses the so-called Encrypt-and-MAC, that is the ciphered message is juxtaposed to a message authentication code (MAC) of the clear message to add integrity. This is not proven to be always fully secure (even if in practical cases it should ...
0
network/circuit based firewalls look no further than Layer 3 of OSI model, and therefore enforce security for TCP/UDP protocls only (e.g. it can only check that say TCP packet flags are legal according to the TCP standard)
application gateways , on the other hand, look up to and including Layer 7 of OSI model and have the understanding of protocols used by ...
0
The CEH won't teach you about security but rather about how to use different types of tools to identify vulnerabilities. It also won't teach you how to use many of the tools to exploit those vulnerabilities so that would come with practice and courses such as those from Offensive Security may be better preparation for penetration type work.
Penetration ...
1
Good question. Let's think about it this way:
You're going to take a basic maths exam and the sign on the door says
"No Masters-level students. No calculators allowed."
A normal inspector (firewall) would ask you for a student ID to make sure you're not an Masters student, then they'd let you in. A Masters student who looks just like you comes to the ...
1
I just did a similar search across some name registrars and it seems that Name.com and GoDaddy both support 2FA, the former using the Verisign/Symantec VIP and the latter using SMS for US numbers only.
1
The answer depends on why the network is isolated and whether or not allowing external access is a problem. Your network must be compliant with whatever security standards and requirements are applicable with the network connected, and presumably you only disconnect it as an added layer of safety, not as a requirement.
Also, it's worth pointing out that if ...
6
I think it's referring to "hub" as the center of a hub-and-spoke VPN architecture, as shown in this diagram.
Later on in the document you linked to, it says:
Dynamic—Dynamic crypto maps can only be used in a hub-and-spoke VPN
topology. Dynamic crypto map policies allow remote peers to exchange
IPsec traffic with a local hub, even if the hub does not ...
2
You have a network that you want to keep isolated, but you're planning to reduce that level of isolation a little bit. I think the most important question you need to ask yourself at this juncture is: "Isolated from what?"
Let's say that you run an Internet-exposed VPN service that leads into this otherwise isolated network. That is likely to be a ...
0
If you are behind a router on your connection then that java applet or script the best it can get is 192.168.1.2 .
Best way to avoid those scripts are : Using your modem and using other router ahead , then use your internet thru the router , when using a vpn and if you enter a website with those scripts to get your real ip , the script will get the ip that ...
1
The remotely (or locally-)powered router approach makes sense, but creates a way to the inside that has to be protected.
The risks of that approach is that someone learns or leaks the information about the phone number - or maybe somebody calls in by mistake (or through wardialing, à la Wargames) - and the router is left powered.
So I'd say that
the ...
3
The standard "old-school" way of doing this kind of thing was to have a dial-up modem that was switched off all the time except when support was needed at which point a change record would be raised for it to be enabled, the remote support person would access the modem and then at the end of the work it would be switched off again.
The manual element ...
1
The answers will be protocol/application dependent. Basically, if you can use a secure tunnel or a VPN solution, you will have pretty good security. Someone might be able to knock on the port, but they won't be able to connect without credentials (and certificates if you can).
You could try to setup a simple VPN using something like Hamachi, TeamViewer, or ...
0
I would use Duplicati (http://www.duplicati.com/) to SFTP the files to the NAS. You could set up a separate share for each backup to isolate the risk of compromise if the password was leaked. Set up your NAS with dynamic DNS and have the clients push the data to the NAS, so that you only have to worry about your IP address, not theirs. Duplicati can also do ...
0
Your network diagram was not attached.
I would download No-Ip on each of the remote workstations you want to back up. Assign them all a hostname and then use the hostname for your firewall rules to allow access. Setting up the firewall rules for the ISP network is not recommended at all.
The port the service is running on is irrelevant. The port ...
5
Don't do it. It's an isolated network for a reason, if you need access do it on site, not remotely so you can also monitor and shut down access locally. As I quote Adnan why you use isolated networks:
You don't isolate your network because you're afraid that someone will guess the right passwords. You're afraid of the human factor, the leakage of the ...
1
Web Application layer Firewall like Modsecurity and Application layer filter like snort ruleset are generally signature bases rule. These rulesets are very comprehensive and covers most of application layer attacks like XSS, SQL injection. Though these firewall have support to protect against DoS through session and user level counters but this not generally ...
0
I would not need "security updates" anyway. I think this way one could
reach nearly 100% security for sensitive documents.
Yes, you absolutely would still need security updates. You stated that you are running on Windows and that you are only allowing the browser to have internet access.
A lot of malware injects itself into the browser's memory space ...
1
Simple. Use a firewall in whitelist mode*.
For a similar purpose, I've used ZoneAlarm Free Firewall. Set it to whitelist mode and wait for it to ask you about giving Internet access to your sandbox application (I've used Sandboxie). Then tell ZoneAlarm to stop notifying you about future applications and not to assume they're whitelisted.
* Whitelist mode: ...
0
You could install VirtualBox and create another VM machine for your Internet access. The host where you don't want any Internet access, disable the network connection by either:
ifconfig ethX down or ifconfig wlanX down (Linux. X is the number
given to the connection)
Control Panel -> Network and Internet -> Network Connection -> Right
Click the connection ...
1
You could have a Linux hypervisor that hosts two windows VMs where by one windows VM doesn't have an internet connection.
(Edit: I guess Windows 2008 can be a hypervisor... but why would anyone want that?)
3
"Root is God". Well, there are gods... and then, there are elder gods.
The root user can do a lot of things on a machine. In particular, he can replace the files which are used to boot the machine; thus, he can potentially replace your kernel with another of his own, which would let him pass. SELinux can be used as a way to make a declawed, neutered root ...
0
Root is not god if you have SELinux enabled. That is the only way I can see to accomplish what you want. Block it with iptables and run SELinux in strict mode.
You might have uid 0 but you won't have the capabilities(7).
0
If it's single homed why would you enable IP_Forwarding? I would assume you would want to forward traffic from one nic to the other. If you had a multi-homed machine then your machine could potentially be used as a proxy into your network. I would call it a pivot point or a jump box into your internal network. But since there is only one interface I'm ...
3
The OpenDNS updater is what keeps track of your IP address for OpenDNS. It uses this IP address to track incoming DNS requests to their service. If the updater is on your PC and you take it to work, OpenDNS will no longer be updating your HOME router IP. It will be updating your work IP. If you have other computers being used at your home you need to ...
2
You seem to have an inaccurate impression of how networks work. Filtering doesn't require knowing what your IP address is and DNS is not an effective means of filtering content. Filters work by checking the content being requested, not where the content is being requested from. Using a DNS server that doesn't return results will stop a very basic attempt ...
2
I just want to add an answer which I think hasn't been touched upon yet. When you connect via teamviewer to another computer, you share your clipboard with that computer (by default).
Therefore, everything you copy onto your clipboard is also copied onto the clipboard of the computer you are connected to. By installing a clipboard tracking application such ...
Top 50 recent answers are included
