New answers tagged network
0
If hackers spoof your IP, they'll be able to send data to your server, but won't receive any data back. This still leaves your server susceptible to denial of service attacks, which could overload your server or, at least, rack up your AWS bill.
Also, if you're traffic is not encrypted (e.g. with HTTPS), then the data in transit is prone to man-in-the-...
1
How can I close ports in windows 10 and what ports are unnecessary to
be open?
You can either use embedded windows firewall to do that, or can use the firewall on the router, if it supports acls
How do I find these open ports to close?
You can use this command:
netstat -an
Or you can use a port scanning software to find out what services are waiting ...
0
You can use nmap for this;
read my answer here:
https://serverfault.com/questions/993783/how-can-i-check-my-pxe-server-configuration/
Gathering the different answers and filtering by e.g. MAC address, you can easily pinpoint the presence of a rogue PXE server.
It should be considered that PXE information (NBP and TFTP server IP) can be located either at ...
0
I had the same problem .
This solved my issue:
Modify the /etc/hosts file .
Change this 127.0.0.1 localhost into 127.0.0.1 local.dev where local.dev can be what you like
1
Most corporate VPN clients (by means of firewall and routing rules) intentionally insulate your computer from all other networks you may be connected to, when connecting to the corporate VPN. This is done in order to prevent your computer from being used as an intermediate for connecting to your corporate network from outside.
When you connect to more than ...
1
Control flow integrity and buffer over flow protection are measures against exploiting coding bugs in a program. Access control is about controlling who can access some device or application etc.
By assuming that access control would be sufficient you assume that a) access control itself is perfect and never has any bugs and b) access control makes sure ...
3
The corporate network is almost certainly segmented into multiple zones or security areas. Between them are firewalls and/or other security systems to control access to those areas.
If you connect a machine that is not a properly configured security device to two networks at the same time, you are creating an uncontrolled bridge between these two networks. ...
0
There are solutions available that provide real-time sandboxing* for files and applications. They are extensively used in mail filtering and malware analysis. Cuckoo is one of them, which is free and can be integrated in various solutions. Consider this, because most product titles that come to my mind right now cost K's :$
*Sandboxing is a technique which ...
10
Depending on your routing table (corporate laptops may have defined route table entries), settings in your network adapters, having or not having a perimeter firewall which filters traffic for VPN users, IPS or IDS, when you connect to any two networks (cable + wifi, cable + hotspot ad hoc) (cable + cable) (bridged) (if network is setup as shared) the hosts ...
27
The risk is not really for your own system but for the corporate network. I assume that the private network is only connected to internet through a secured firewall, and that through the VPN you get access to that private network.
If you manage to have your machine connected at the same time to a public network and to the VPN, it will constitute a new ...
1
Both: Yes/No
Sticking with the question, it seems this is not mission critical project.
So might be one solution would be to detect malicious program based on signatures or in one word signature-based detection.
But to create huge database of signatures and maintaining is another job, where antivirus/antimalware products are good at.
So using good Anti-...
2
Since you are talking about SSID, I assume you connect over a WiFi Network to your cable modem.
WiFi is open in the sense that anyone can listen to the packets anyone exchanges with the WiFi access point, even when the connection is encrypted.
It only requires a WiFi network card/USB Stick etc. working in promiscuous mode, and you can see all packets in ...
3
No you can't, not all the time reliably. To detect viruses simply by static analysis would likely contradict Rice's Theorem which says that such problem is undecidable.
0
In general, no it is not possible. You might be able to get some benefit from a network intrusion detection system (ex: snort) or some anti-virus software. But nothing will guarantee safety. For the most critical of infrastructure, you should verify the hashes that have been cryptographically-signed by the software vendors. Short of that, at least make sure ...
-1
The only reasonable way I can think of to perform this idea, would be that your neighbor somehow has access to your network or one of your devices, while he's inside your network he's able to know how many devices are turned on because they have an IP.
In another scenario we can assume also he has access to one of your devices remotely, in this case a ...
4
Who is the target for bot nets?
A lot of botnets use consumer devices that are insecure by default, or are shipped with vulnerable software.
Imagine you buy the ACME HomeLink™ wireless router, which comes with a neat administrative console for customer comfort. If you have a problem, all that customer service has to do is connect to your router on port ...
2
@multithr3at3d gives a good answer about what you are directly asking for.
However, you may not have considered whether your "personal security" is diminished as a result of this policy:
If some individual or government knows your IP address, by turning off your modem on a holiday, this tells a third-party that you're away from the house.
5
Generally speaking, a vulnerable device/network doesn't become less vulnerable if it is turned off some of the time. Or if you have infected devices on the network, this won't make them any less infected.
However, it may reduce the probability of your router or any exposed service from becoming infected any given day. I guess you could also argue that an ...
0
Well, first of all you are behind a NAT of a cell phone operator equipment. Secondly, your IP changes frequently - reconnecting to different cell towers will do that (there are many factors to that). Thirdly - there are have to be either zero-day vulnerability or some services running on your phone accepting external requests to be vulnerable.
Phones are ...
3
While the official remediation recommendation from Nessus (as you like know) is to explore patching, it is likely a generic piece of advice. I would agree that there is merit in the suggestion by symcbean that the web server (Apache in your case) is potentially not the root cause, rather the code that it is serving.
There are some useful resources for ...
0
I am not aware of anything in Apache providing session management - session state is managed elsewhere, in PHP, PERL, python....of course, if I really tried I could leverage mod_usertrack or mod_session to create a very bad and insecure session implementation....but that would be rather dumb. The session has no value without application logic to read and ...
1
My opinion is that it is highly unlikely that your device was compromised by your friend in the way you describe.
A much more likely way to exploit this situation would be to monitor your web traffic while connected. Doing this might allow him to see what types of websites you are going to while you are connected to his wifi, but usually won't allow him to ...
0
I wouldn't because then you're relying on outside network infrastructure for your security.
I'd recommend creating an internal proxy server that injects credentials.
In reality, this will probably work just fine, but if it were something highly sensitive, I'd go with my previous recommendation, it's pretty easy to setup.
1
Yes and No.
Yes - because you will be safe from non-targeted external attacks (if your website does have proper settings for not leaking data on denied requests, etc, but that was not the question). It's almost impossible to spoof IP from outside the perimeter (not being man in the middle), however still possible, but that would require quite a lot of ...
2
The question asked is "Is it acceptable in this case to rely on IP as an authentication [mechanism]?"
The short answer is: It depends.
Let's start with a definition of authentication. Merriam-Webster defines authentication as
": an act, process, or method of showing something (such as an
identity, a piece of art, or a financial transaction) to be ...
-1
You should use IP address for authorization, but not for authentication. Authentication is who you are, authorization is what you are allowed to do.
If you use IP address for access control, you don't have authentication. You don't know who used what, and any audit trail is useless. But it works for simpler cases, like a read-only documentation site for ...
1
Is it acceptable in this case to rely on IP as an authentication mechanism ?
Yes, because performing an attack that will spoof a connection requires the attacker to be placed in a very very specific location along the path of communication. So you are safe from that.
The above holds, assuming you don't have any confidential data and you just want to allow ...
1
You asked three questions:
Requested general understanding of firewalls
How do stateful firewalls protect against non-udp-tcp protocols?
Can data exfiltration occur over non-udp-tcp protocols?
Understanding firewalls background
Firewalls (as opposed to routers with access-lists) are stateful devices. When a socket is initiated in one direction, the ...
1
TCP and UDP are layer 4 (transport protocols), and ports are an addressing feature particular to them. There are many other protocols, and they do not use ports. While malware often uses TCP or UDP, mostly to "hide" among normal traffic, it can use other protocols, or even one that the malware writers created on their own.
As Rashad pointed out, advanced ...
0
I understand that TCP and UDP are easy to filter. Programs on a
computer need to ask the OS to open a port and will listen to these
ports. Firewalls can simply look at all incoming packets, check the
port number, and decide to allow it or not, based on the sending IP.
Are there attacks on other protocols ? What do firewalls do to protect
from ...
0
tl/dr: If money is involved then you need a way to verify your webhook
transactions. Your security keys, however, are probably fine,
although in the end that is a business decision for you to make.
Private webhook endpoint
Your concerns over a private webhook endpoint are quite valid. In fact, this is one of the biggest dangerous for webhook ...
0
It can infect via SMB shares or forged packets or it can infect the very router (botnet). It all depends on what kind of malware running on the infected laptop. The bare minimum you can do is - switch on all (I assume windows) devices from private to public network, disable shares, enable firewall, turn on UAC.
For the router - if it's possible create ...
0
Untrusted devices should be on their own, segregated network. Some wifi routers have a "guest" network, some separate the wifi from the ethernet. That's your best route.
Being on the same network means that any infection on the untrusted device can attempt to reach out to your own devices. The impact of that might be low, but that requires some ...
0
linux: no more kernel patches.
On newer kernels, you can use
net.ipv4.tcp_timestamps = 1
Enable timestamps as defined in RFC1323 and use random offset for each
connection rather than only using the current time
They choose to change the semantic: in old kernels, tcp_timestamps = 1 enables timestamps backed by time.
Now to get the old behaviour, you ...
Top 50 recent answers are included
