Timeline for Do machines without any listening services need a firewall to block incoming connections?
Current License: CC BY-SA 4.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 15, 2021 at 17:17 | vote | accept | Mikhail Morfikov | ||
| Oct 15, 2021 at 17:17 | |||||
| Oct 7, 2021 at 23:21 | comment | added | Mikhail Morfikov | @Mark, good to know. | |
| Oct 6, 2021 at 22:17 | comment | added | Mark | @MikhailMorfikov, with the default settings, nmap will slow down and make repeated tests when a packet doesn't get a reply, in an attempt to tell the difference between packets dropped by a firewall and packets dropped due to network congestion. | |
| Oct 6, 2021 at 16:51 | comment | added | Mikhail Morfikov |
@Mark, I didn't really test much using nmap, only -p 1-65535 , and the same scan was conducted with and without DROP in INPUT, and there was a huge difference in time to complete such scans.
|
|
| Oct 4, 2021 at 22:21 | comment | added | Mark | @MikhailMorfikov, nmap is designed for accuracy, not speed. A rapid portscan that's willing to accept the occasional false negative can scan every port in a matter of seconds regardless of firewall policy. | |
| Oct 4, 2021 at 22:14 | comment | added | Mikhail Morfikov | @Mark, yes ICMP and port scans are the things to keep in mind. For instance a full port scan (via nmap) takes 15s, whereas with INPUT DROP, it takes 2h or so? I don't remember but there's a huge difference here. | |
| Oct 4, 2021 at 22:11 | comment | added | Mikhail Morfikov | @Polynomial, it's not really a Android phone specific question. You can have other machines with no listening services as well -- it just depends on the configuration. | |
| Oct 4, 2021 at 12:27 | comment | added | R.. GitHub STOP HELPING ICE | @Mark: Did you read my answer? It mentions nukes already, as mostly as thing of the distant past. | |
| Oct 4, 2021 at 6:11 | comment | added | Mark | @R..GitHubSTOPHELPINGICE, "services" are a lot broader than you're picturing. Almost any computer on the Internet is listening for things like ICMP, and those have been used for attacks. | |
| Oct 3, 2021 at 17:06 | comment | added | Polynomial | @MikhailMorfikov It would've been helpful, then, if you'd have mentioned Android at all in your question, or tagged it with the Android tag. | |
| Oct 3, 2021 at 16:59 | comment | added | Mikhail Morfikov | There is a major group of devices that don't have any listening services -- it's android phones. The devices don't filter any incoming connections. And this was the source of my question. | |
| Oct 2, 2021 at 13:44 | history | edited | Polynomial | CC BY-SA 4.0 |
added 32 characters in body
|
| Oct 2, 2021 at 13:43 | comment | added | Polynomial |
@R..GitHubSTOPHELPINGICE I don't disagree that there are Linux/BSD distros that don't come with application-layer services listening by default, albeit with the most popular distros not being among them. However, while those cleaner distros might not have SSH or NFS or finger running by default, they almost certainly have DHCP, LLDP, ICMP, a DNS client, etc. as part of the typical network stack, and those services do have an attack surface that can be reduced by a firewall. I'll edit to clarify what I meant by "modern", though, since it was a poor choice of word.
|
|
| Oct 2, 2021 at 3:20 | comment | added | R.. GitHub STOP HELPING ICE | "Not really, if we're talking modern operating systems." <-- some of us would not call that "modern" but "broken". All BSDs and Linux distributions I would consider using in a serious environment have no listening services by default. On the other hand, plenty of historical bad systems had lots. There is no correlation with "modernity" here, just with bad choices. | |
| Oct 1, 2021 at 16:10 | history | answered | Polynomial | CC BY-SA 4.0 |