Hot answers tagged

16

The first and main thing is to ensure that the firewall on your host is configured to properly drop incoming packets with source or destination address set to 127.0.0.1. Under normal circumstances, there should be no packet coming from the network and showing such addresses. However an attacker may attempt to forge such packets in order to reach your local ...


10

Internet service providers do typically keep a detailed record of which dynamic IP address is assigned to which customer at any given time. However, in general they will only give out this information to law enforcement if they receive a court order, to protect privacy. As for MAC address, the ISP probably also knows the MAC address of the home router used ...


6

The DHCP server logs will have a record of what MAC address was issued with what IP address in the past. I do this in my own corporate network to look for anomalies. But your question is about public IP addresses. The same principle applies, and this data is not public information: you'd have to get access to the logs of the networking devices. So, for the ...


5

If the service provides a web interface it might be vulnerable to CSRF attacks, XSS attacks or "same site" scripting. All of these can be triggered by just visiting the attackers external website, which by itself might be caused by malvertising or phishing. For these attacks it does not matter if the service is listening only on localhost, because it is only ...


2

Since NAT allows only replies to outbound connection no direct attacks from outside to inside are possible. But simple denial of service attacks are still possible. And while (D)DOS does not affect the inside network directly it can lead to a denial of critical services which need the access to the outside, like phone (VoIP) or smart home services. ...


1

TOR fulfils both your requirements quite nicely. Additionally, for your first point, there was no routing protocol used, as such - attackers would literally connect to a 2nd machine, and from there connect to a third etc - using plain old TCP/IP.


1

The real AS to feed a false route is any AS along the AS path: 7908 --> 20080 --> 1251 --> |28571| |52888| --> 6447 you see in the 2 wrong announces of route to: 8.8.8.8/32 Hence all traffic toward 8.8.8.8/32 shoud be routed since this attack through ASes: |28571| |52888| --> 1251 --> 20080 --> 7908 ...


1

The only real reason to prevent a network from being routable through a firewall is to make sure it's isolated both from external and internal unauthorized access. It's impossible for someone to hack into a system if there is no physical path for electrons to travel from their position to the target system's position. By unplugging any cables linking the ...


1

The answer depends on different factors. A few that may or may not apply: What protocol is it? (For example UDP is more prone to security issues in this case as it works statelessly and you might achieve something with a single spoofed packet). Do you consider attacks or only data access. (See above: you might be able to do a DoS attack for a faulty UDP ...


1

Also consider that the hostname localhost is not exactly the same as the IP 127.0.0.1 (it naturally needs to be resolved first), and in most situations relies on either an entry in the hosts file or a resolver/dns server capable of resolving 127.0.0.1. So, be sure you can strictly specify 127.0.0.1 instead of localhost when implementing security measures, ...


1

To answer question 1, I don't think either setting is as secure as you ought to be. Option 1 leaves masq turned on for the WAN when it doesn't need to be. Option 2 sets up a default accept rule for the WAN when it doesn't need to be. To answer question 2 and fill in the blanks on question 1: The input/output rule settings in OpenWRT are the default ...



Only top voted, non community-wiki answers of a minimum length are eligible