Tag Info

Hot answers tagged

16

The first and main thing is to ensure that the firewall on your host is configured to properly drop incoming packets with source or destination address set to 127.0.0.1. Under normal circumstances, there should be no packet coming from the network and showing such addresses. However an attacker may attempt to forge such packets in order to reach your local ...


6

I must disagree with @vahid. If there are multiple hops between the NAT and the host to which the connection is being port-forwarded, you may actually be able to elicit an ICMP TIMEX message. As you may know, every IPv4 packet has a 1 byte TTL field. If you determine the distance to the NAT (say 10 hops) and the actual concealed host is actually 12 hops ...


5

If the service provides a web interface it might be vulnerable to CSRF attacks, XSS attacks or "same site" scripting. All of these can be triggered by just visiting the attackers external website, which by itself might be caused by malvertising or phishing. For these attacks it does not matter if the service is listening only on localhost, because it is only ...


2

What you are trying to achieve is not possible, by design. The only way of achieving this is by having access to either the gateway or the host machine. A NAT device serves the dual purpose of sharing an internet connection with an internal network and protecting the internal network much like a traditional firewall would. [edit] I stand corrected. The IETF ...


2

Since access has been sufficiently restricted, the weakest link is the HTTP request. This is especially true based on comments regarding the poor interfaces of the IP cameras. They likely won't do well if irregular requests are sent. Therefore consider a Web Application Firewall (WAF) such as ModSecurity as it will provide more flexibility over what ...


1

The answer depends on different factors. A few that may or may not apply: What protocol is it? (For example UDP is more prone to security issues in this case as it works statelessly and you might achieve something with a single spoofed packet). Do you consider attacks or only data access. (See above: you might be able to do a DoS attack for a faulty UDP ...


1

Also consider that the hostname localhost is not exactly the same as the IP 127.0.0.1 (it naturally needs to be resolved first), and in most situations relies on either an entry in the hosts file or a resolver/dns server capable of resolving 127.0.0.1. So, be sure you can strictly specify 127.0.0.1 instead of localhost when implementing security measures, ...


1

To answer question 1, I don't think either setting is as secure as you ought to be. Option 1 leaves masq turned on for the WAN when it doesn't need to be. Option 2 sets up a default accept rule for the WAN when it doesn't need to be. To answer question 2 and fill in the blanks on question 1: The input/output rule settings in OpenWRT are the default ...


1

Tor is best known for providing anonymity to the users communication. Every time tor uses different routes to forward the data to destination to maintain anonymity. If it is not doing so then same path can be traced to intercept the communication. I think this is the best method to anonymize the communication.


1

You are unable to see the rest of the network now because you have connected a router between and you are now basically on a 'separate' network --- check the IP addresses --- if they are not all in the same CLASS then you are on different networks and cannot see everything, although, technically everything is connected together. Secondly, a mac address is ...


1

Yes, your ISP is very clearly hijacking not only the DNS for google, but also DNS requests you try to send to outside DNS servers. You are correct in your analysis that the traffic to Google is not leaving your ISPs network. Your traceroutes also show that your DNS queries to Google Public DNS, as well as to Level 3's open resolvers, are not leaving your ...


1

It depends on the original firmware you are replacing, however it could be more secure than many "consumer" router firmwares because it does not support WPS at all (which is a known security risk)



Only top voted, non community-wiki answers of a minimum length are eligible