New answers tagged

1

If you're trying to protect against mostly-benign software, this should work fine. Some software might make its own DNS calls (bypassing the OS DNS resolver, which checks the hosts file) and some will probably use direct IP addresses, but most by far will just ask the OS to resolve the names. If you want to restrict potentially-malicious software, this is ...


1

Indeed, if you want to restrict access to the instance metadata service -- so that only a specific list of users can query it, you need to have an OS-level control instead of a network-level control. The reason is simple, users are an OS concept, and packets from different users on a OS reaching out to the instance metadata service would look ...


0

This question is no longer relevant for me since AWS updated access to their Metadata api to acquire a token first and than add that to a header, reducing the usefulness for a potential SSRF. This still keeps the SSRF as a threat in scenarios where for example advanced web hooks are used. REF: https://aws.amazon.com/blogs/security/defense-in-depth-open-...


0

If ZoneAlarm is preventing your application from connecting to the network you can find the Related logs and when you read the log you can find why it has been blocked and therefore you can find the right solution to solve the issue, here is ZoneAlarm Alert and Logs documentation. ZoneAlarm has an application control mechanism that should be configured ...


0

You maybe need to disassemble the device in order to figure out if the firmware can be upgraded. A cheap mouse or keyboard is usually "safe" more expensive aka more feature rich ones can be upgraded sometimes. For flash drives there are some open source versions like the nitrokey and others where you can flash your own firmware and afaik write protect it. ...


0

"That allows to prevent the use of a potential bug in the network driver." In the host ... The network VM is now the vulnerable part and certainly one of the more important VM's. "How can I reproduce the same configuration ? I thought about using Xen with a virtual network, but I would like to know if somebody already made it." Depends on the hypervisor ...


Top 50 recent answers are included