New answers tagged

1

None of the symptoms you posted is a sign of having malware on your computer. My internet connection slows to a crawl often Complain to your internet service provider or find a better one. my games keep crashing Viruses don't tend to do that. When you have problems running games, it's far more likely to be a problem with your graphic driver... or ...


0

There is no sure way to tell. You can find a virus on your computer, and then I guess you'll know that there is a virus. But it is not possible to be sure that there is a virus responsible for all of the suspicious activity on your computer. It is equally possible that someone is hacking into your computer and screwing around with it. But in terms of ...


0

I agree with Steffan that QUIC is no more dangerous than TCP or UDP or HTTP or any other communication protocol. I think for your use case what really matter is the data being transferred through the protocol. Like Steffan said, it really depends on the firewall and the concerns you are trying to address using that firewall. Doing an informal threat ...


1

QUIC by itself is no more dangerous than TCP, UDP, HTTP ... . What matters is the content transferred with the protocol. If you use your firewall only as a simple packet filter and don't do any content inspection (i.e. malware, URL filter etc) then it does not matter much if you allow QUIC or not. If instead your firewall is used to analyse HTTP(s) traffic ...


0

Anyone over the internet can SMB connect to your workstation if Router is port forwarding SMB to you. To check try smbclient \\\\router_ip\\smb_share_name. Router is not properly configured to block port forwarding request from external networks. The best thing you can do is to firewall SMB ports to all IP's except internal IP's using iptables.


2

I got the time to track it down, and it looks like I found the answer. It's 'adb', the Android Debug Bridge service, installed with the Google Android tools package. I had put it on my machine to help unbrick my daughter's phone (don't ask) and forgot to shut it off. But that was months ago, and like I said I didn't see the traffic in my desktop widget ...


0

I would like to know what else can I do to improve my security? First of all, you should make sure you use the newest firmware for your linksys device (if you use it). I wouldn't recommend to connect your Windows PC directly to the internet. Doing so allsows a potential attacker to directly "access" and gather information about the target machine ...


0

My recipe was and is : Portsentry Proper firewall Retailating NMAP Auto-mailing via Perl scripts to abuse@xxx from whois from reverse DNS Auto-reporting to blacklists for malicious IP's Enforcing a list of bad IPs to HTTPS/SMTPS/IMAPS/POP3S It worked and it works, but it took some time for assistance


1

It looks like you're seeing a LOT of bad connections (syn connection immediately followed by rst flags). This means you're trying to make a connection to yourself via localhost, and the connection is being closed (reset) by the TCP/IP stack. By any chance are you using a hosts file to redirect ad/malware domains to localhost (172.0.0.1)? That would cause ...


0

HotSpot shield may be using an active response to handle as a intrusion detection / prevention and to prevent network abuse. Probably a lot of users may be using their service in order to perform port scans, and HotSpot is protecting itself. So, it may be their firewall / gateway / ... sending you a response, not the rteal target.


0

This guy explains it well. An open port is an open door. Once one door is opened, the device in question can be used to target other devices in the same network. The linked document explains how the author got into the Hacking Team's internal network and leaked their data.


0

Have you ever tried to perform network communications with a rock? How about a network router that has no electricity? It's pretty boring, because you get no response. So attackers try to use the most common network protocols, like TCP and UDP, which use numbers that are called "port numbers", or "ports". (SCTP also uses ports.) If a port is closed, ...


1

As Girish points out, a port scan is like casing a house. Its a a very low noise activity when done from the internet, because you'll see dozens of port scans a day. It also gleans a small amount of information about the state of your machine, and that lets them tailor the next layer of the attack even more. It's also dirt cheap! Doing a port scan costs ...


4

Consider that I wanna rob your home ... Then I would look up for a way to get into. But your home has door locks that allows only your local(family) to access it so I will search for some other like way(ports) windows(other open public ports) to get into.And try to get some data. If ports will be open for ssh/ftp they try to exploit them. Try uploading files ...


38

To run an exploit, an attacker needs a vulnerability. To find a vulnerability, the attacker needs to fingerprint all services which run on the machine (find out which protocol they use, which programs implement them and preferably the versions of those programs). To fingerprint a service, the attacker needs to know that there is one running on a publicly ...


1

The other way to look at it is from the firewall end and monitor the traffic from the host as it hits the firewall. This is a good way, as it allows you to see anything getting blocked and the firewall already has to deencapsulate the traffic. Eithter that or back to the manual method, most apps that use communictations publish this data in the manual or on ...


6

The difference is in the very nature of the two protocols. TCP is a connection-oriented protocol. This means that systems must establish and confirm a stable connection - for TCP, the process is commonly known as the "three-way handshake" - before data is actually transferred. As the process must happen quickly for a good connection, it can be reasonably ...


4

From the nmap page A big challenge with UDP scanning is doing it quickly. Open and filtered ports rarely send any response, leaving Nmap to time out and then conduct retransmissions just in case the probe or response were lost. Closed ports are often an even bigger problem. They usually send back an ICMP port unreachable error. But unlike the RST ...


2

They are different protocols. At UDP you have to wait for the answer for a specified timeout, at TCP you instantly see that a port is open after getting the three-way handshake. If it's closed, you are most likely to get a packet with the RST flag set, so also you can instantly move on to the next port. It is possible to achieve some extra speed for UDP ...


0

Assuming that you've used one of the standard scan types initially (e.g. SYN or TCP scan) and you're getting back no open ports, I'd say that either the system has no open ports (the most likely real-world scenario) or there's some specific point your course is trying to teach (should be mentioned in the course materials) that would require a specific scan ...



Top 50 recent answers are included