0

I'm running https://ngrok.com/ on Windows 10 pro with a custom app made on Node server running locally (can't be Linux) for a test suite that uses both web and desktop integrated. So I'm basically hosting a server on the machine for another internal machine to access via the internet (there is no other way to solve the problem). Not considering securing the app itself but in case someone discovers the IP of the machine what can I do to secure it? The machine cannot use VPN, it's not connected to a domain but just plugged into ethernet. Only minimum software is running and everything else was removed. Everything is up to date and Bitdefender is installed.

0

So I'm basically hosting a server on the machine for another internal machine to access via the internet ....

In this case protect the access with authentication, so that only this other machine can access your server. When using the authentication build into ngrok only authenticated requests will reach your server which should greatly limit the attack surface and should allow access only for trusted peers.

| improve this answer | |
  • Yes there is authentication. Yes I will do whitelisting. The machine is the server. I will try to protect the app but what if someone tries a cold attack directly in windows? – Daniel Vianna Jan 3 at 15:58
  • @DanielVianna: I don't know what you mean with "cold attack". But in order to attack Windows the attacker must reach your system first, which means that the attacker must be a user successfully authenticated by ngrok. And the attacker must then exploit a bug in your application in order to execute code on the system. If you want limit the risks associated with this don't run the application on plain windows but inside some sandbox, VM ... and/or isolate your server from other systems in the network with firewalls etc so that an attacker cannot attack other systems there. – Steffen Ullrich Jan 3 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.