I'm running https://ngrok.com/ on Windows 10 pro with a custom app made on Node server running locally (can't be Linux) for a test suite that uses both web and desktop integrated. So I'm basically hosting a server on the machine for another internal machine to access via the internet (there is no other way to solve the problem). Not considering securing the app itself but in case someone discovers the IP of the machine what can I do to secure it? The machine cannot use VPN, it's not connected to a domain but just plugged into ethernet. Only minimum software is running and everything else was removed. Everything is up to date and Bitdefender is installed.
1 Answer
So I'm basically hosting a server on the machine for another internal machine to access via the internet ....
In this case protect the access with authentication, so that only this other machine can access your server. When using the authentication build into ngrok only authenticated requests will reach your server which should greatly limit the attack surface and should allow access only for trusted peers.
answered Jan 3, 2020 at 6:20
-
Yes there is authentication. Yes I will do whitelisting. The machine is the server. I will try to protect the app but what if someone tries a cold attack directly in windows? Commented Jan 3, 2020 at 15:58
-
@DanielVianna: I don't know what you mean with "cold attack". But in order to attack Windows the attacker must reach your system first, which means that the attacker must be a user successfully authenticated by ngrok. And the attacker must then exploit a bug in your application in order to execute code on the system. If you want limit the risks associated with this don't run the application on plain windows but inside some sandbox, VM ... and/or isolate your server from other systems in the network with firewalls etc so that an attacker cannot attack other systems there. Commented Jan 3, 2020 at 16:20