Possible Security Risks

I got my AirportExtreme base station connected to ISP via fibre-optic modem via PPPoE assessed by Comodo.com, and it gave these possible security threats. It was even possible to tell how long had the airport connected to Internet via PPPoE, which was bit of scary.
I do not know how to make it stop responding to ICMP pings coming from outside, which is also a considerable potential security threat.
I do not know how to fix them. Does anyone know? (I paste some excerpts from the security report for reference.)
*1. Security warning found on port/service "osu-nms (192/udp)"
The remote host is an Airport, Airport Extreme or Airport Express wireless access point. It is possible to gather information about the remote base station (such as its connection type or connection time) by sending packets to UDP port 192. An attacker connected to this network may also use this protocol to force the base station to disconnect from the network if it is using PPPoE, thus causing a denial of service for the other users.
Solution : Filter incoming traffic to this port, make sure only authorized hosts can connect to the wireless network this base station listens on.
Risk factor : Medium / CVSS Base Score : 4 (AV:R/AC:H/Au:NR/C:N/A:C/I:N/B:A) Plugin output: - The station has been connected to the network for 10 days 12h47m28s - The station is connected to the network via PPTP.
*2 Security warning found on port/service "general/icmp"
Synopsis : It is possible to determine the exact time set on the remote host. Description : The remote
host answers to an ICMP timestamp request. This allows an attacker to know the date which is set on
your machine. This may help him to defeat all your time based authentication protocols.
Solution : filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).
Risk factor : None / CVSS Base Score : 0 (AV:R/AC:L/Au:NR/C:N/A:N/I:N/B:N)
CVE : CVE-1999-0524
iBook G4 Mac OS X (10.4.6) Using AirportExtreme Base Station (Firmware ver. 5.7)

I got my AirportExtreme base station connected to ISP
via fibre-optic modem via PPPoE assessed by
Comodo.com, and it gave these possible security
threats. It was even possible to tell how long had
the airport connected to Internet via PPPoE, which
was bit of scary.
I do not know how to make it stop responding to ICMP
pings coming from outside, which is also a
considerable potential security threat.
Actually you can't. You can't manage the firewall
filtering within an ABS, an AEBS or an AX. They
look like they share the exact same code for this
part of their software.
I do not know how to fix them. Does anyone know? (I
paste some excerpts from the security report for
reference.)
You have 2 architectural ways to improve the protection
of your network (on the Internet side):
- introduce a firewall between your modem and your AEBS;
- use a Mac as a firewall router:
* connect this Mac via Ethernet to your modem;
* configure its firewall (and enable logging);
* configure the sharing of this Ethernet connection
to AirPort.
*1. Security warning found on port/service "osu-nms
(192/udp)"
*2 Security warning found on port/service
"general/icmp"
These aren't really serious risks. But you should report
them to Apple. Why for?
Because there are really serious risks around the use
of the AirPort base stations (all of them) and some of
them are already reported to Apple.
Apple should be aware that many of their customers are
tired of networks, Internet, softwares and OSes they
can't trust.
dan

Similar Messages

Web form and database security risk

I'd like to develop an Oracle Form or APEX Form where people don't have to login to use it. Like a registration form on our website, where anyone can fill it out. Ideally, the information entered into the form would be saved to an Oracle table (could use a flat file if database security is an issue). I'm a developer and don't know a lot about the security side.
I'm thinking we would need a static IP address and an Oracle public password that doesn't expire, since the public doesn't have to login to use the form.
Is this possible and is it a database or network security risk ?

An APEX page can certainly be configured to not require authentication (that's pretty standard for the login/ registration page). There is no need for an "Oracle public password." There are accounts in the Oracle database that APEX uses but that no human needs to know the password for. If that's what you mean by "Oracle public password" then, yes, you do. But that would be the case no matter what authentication and authorization scheme you use in APEX.
A static IP address for your web server is likely a good idea. It's possible to have DNS work with dynamic IP addresses but that's probably not what you want.
Justin

Is Bitdefender safe? If not, what security risks do I run?

Is Bitdefender safe? If not, what security risks do I run?

Mac users often ask whether they should install "anti-virus" (AV) software. The usual answer is "no." That answer is right, but it may give the wrong impression that there is no threat from what are loosely called "viruses." There is a threat, and you need to educate yourself about it.
1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions.
It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to take control of it remotely. That threat is in a different category, and there's no easy way to defend against it. AV software is not intended to, and does not, defend against such attacks.
The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't been checked for security by Apple unless it comes from the App Store, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
☞ It can easily be disabled or overridden by the user.
☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
Apple has taken far too long to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. Those lapses don't involve App Store products, however.
For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is a problem of human behavior, not machine behavior, and no technological fix alone is going to solve it. Trusting software to protect you will only make you more vulnerable.
The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and Internet criminals. If you're better informed than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
Software from an untrustworthy source
☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software. A genuine alert that Flash is outdated and blocked is shown on this support page. Follow the instructions on the support page in that case. Otherwise, assume that the alert is fake and someone is trying to scam you into installing malware. If you see such alerts on more than one website, ask for instructions.
☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
☞ Rogue websites such as Softonic, Soft32, and CNET Download distribute free applications that have been packaged in a superfluous "installer."
☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
Software that is plainly illegal or does something illegal
☞ High-priced commercial software such as Photoshop is "cracked" or "free."
☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission. All "YouTube downloaders" are in this category, though not all are necessarily malicious.
Conditional or unsolicited offers from strangers
☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
☞ You win a prize in a contest you never entered.
☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
☞ Anything online that you would expect to pay for is "free."
Unexpected events
☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a padlock icon in the address bar when visiting a secure site.
Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
7. Never install any commercial AV or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
Why shouldn't you use commercial AV products?
☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
☞ Most importantly, a false sense of security is dangerous.
8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It can be as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

Portable hard drive no longer requires password to decrypt it - security risk

I have a WD passport for Mac. It was previously encrypted and i would have to enter a password every time I wanted access to the drive - perfect. But then I had to decrypt it and when I had finished I re-encrypted the drive once again by right clicking and selecting encrypt drive. The drive is now encrypted again which is good, but the problem is that when I now plug it into my MBP the files are automatically accessible...the drive doesn't require a password to decrypt it anymore.
This is obviously a security risk so i want to go back to having to provide a password to unlock the drive. I've read some stuff about the password being saved in keychain but not had any luck looking for it and I'm a bit of a novice!
I'm using a 2012 MBP Retina with the latest OS
Can anyone help please?

This procedure is a diagnostic test. It makes no changes to your data.
Please triple-click anywhere in the line below on this page to select it:
{ diskutil list; echo; diskutil cs list; } | pbcopy
Copy the selected text to the Clipboard by pressing the key combination command-C.
Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad and start typing the name.
Paste into the Terminal window by pressing the key combination command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting.
Wait for a new line ending in a dollar sign ($) to appear below what you entered.
The output of the command will be automatically copied to the Clipboard. If the command produced no output, the Clipboard will be empty. Paste into a reply to this message.
The Terminal window doesn't show the output. Please don't copy anything from there.
If any personal information appears in the output, anonymize before posting, but don’t remove the context.

Are there any good tool for checking security risks, Code review, memory leakages for SharePoint projects?

Are there any good tool for checking security risks, Code review, memory leakages for SharePoint projects?
I found one such tool "Fortify" in the below link. Are there any such kind of tools available which supports SharePoint?
Reference: http://www.securityresearch.at/en/development/fortify/
Amalaraja Fernando,
SharePoint Architect
Please Mark As Answer if my post solves your problem or Vote As Helpful if a post has been helpful for you. This post is provided "AS IS" with no warrenties and confers no rights.

Hi Amalaraja Fernando,
I'm not sure that there is one more tool that combines all these features. But you may take a look at these solutions:
SharePoint diagnostic manager
SharePoint enterprise manager
What is SPCop SharePoint Code Analysis?
Dmitry
Lightning Tools Check
out our SharePoint tools and web parts |
Lightning Tools Blog | Мой Блог

Windows 8.1 Security Risk / Not able to log off a user

Hello Community,
First and foremost good morning, I hope everyone is having a good morning. I'm in dire need of a solution. The company I work for has four (4) standalone computers with Windows 8.1
which are located in a break room for, you guessed it, breaks! They are not on the domain but are on a workgroup. A former user from the company has one of these machines completely locked up. Here's what I mean:
When a user sits down at one of these computers they click on the account Breakroom1, Breakroom2, etc....up to 4 which lets them login. However, somehow a user has logged in with
an outlook account and there is absolutely no way for me to log this person out. I can't right click anywhere and get a logoff button. I can't right click on the red circle and get an option to log this person out. The only options I get
are restart, sleep, and shutdown. I've browsed through setup to see if there were any options to kick this person off. I'm completely stumped. I believe this to be a security risk because no one has been able to do anything about this.
I'm trying veryhard not to reimage this machine.
If anyone has any ideas I will gladly try them out and I thank everyone in advance for their time.
Respectfully,

Hi Ricky ,
“somehow a user has logged in with an outlook account and there is absolutely no way for me to log this person out.”
Do you mean someone connect the Microsoft account with the local account and then the machine is locked now. You can`t get into the machine unless you know the Microsoft account`s password, right?
To solve this problem ,I am afraid you have to contact the Microsoft account`s owner firstly to unlock the account. To avoid this tiresome issue in the future, I recommend you take the following steps:
1.Log on the computer as an administrator
2.Run the gpedit.msc and look for the following group policy and set “Users can`t add or log on with Microsoft accounts”,
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Accounts: Block Microsoft accounts
3.Run gpupdate /force
4.I recommend you take this solution to the others` pcs in the Breakrooms .
Best regards

Can not open multiple excel 2003 and excel 2007 files in excel 2010 - message says they may be a security risk and wants to do a scan

We use about 20 excel files to build a consolidated financial statement for our company. Some of the files were built when the computers were running 2003 and some when we had 2007. We are being upgraded to Windows 7 with Office 2010. In
2007, we would simply highlight all the files in a folder, right click, and open. Once they had all refreshed for new data, we would close them all. Now with Excel 2010, we've highlighted all the files, but when we right click, we get a message
that says some files may present an internet security risk. Then it ask if we want to open anyway. If we say yes, we get a box that asks us to scan the files. We've done a scan, but at the end it still doesn't open the files. If we
say no, it does nothing. Either way, we're not getting the files open except to open them 1 by 1. We're not sure how to get rid of this...any suggestions?

In Excel 2010 setting those documents as trusted documents, or adding the folder containing as a trusted location may do the trick for you. There's a full description of what it does here
http://blogs.technet.com/b/office2010/archive/2009/09/28/trusted-documents.aspx but if you go into File, Options, Trust Center, Trust Center Settings..., and then Trusted Locations, you'll see the list of currently configured file paths that are considered
trusted on your machine.
At the bottom of that window you can check the option to allow trusted locations on the network (so you can trust the files that I assume are stored on a network location) and then add the location of those files to the list.
Note, this setting is done per machine profile, so if it does the trick for you then each person needing these files would need to do this. Also, keep in mind that by doing this you're removing some of the protections added into Excel, so you should only
go adding locations you know you can trust (not just the root of a network path where anyone and everyone might go saving spreadsheets they've downloaded form the internet).

Firefox deleted a program and I need it back - where can I see a list of programs Firefox deemed a security risk?

Firefox reported a program as security risk and I hurriedly deleted. It is not a virus it is a very important program I need o work. How can I retrieve this program?

you're probably referring to the deactivation of the java plugin - go to [java.com] and download the latest version that has the security vulnerabilities already fixed.
also see [[Unblocking the Java plugin]]

Is Hulu a Security Risk for OS X?

I can't find an uninstaller, or a list of what their +Video Player+ installs. I went to stream an ABC show, and one of the fine-print clauses in the Agreement states:
+"Disney may configure The Software with certain tags that identify the version of The Software being used which permit Disney to *update this version without further notice* to you."+
Is Hulu a security risk, or spyware, or is it on the level?
Thanks.

After reading their Privacy statement & TOU, it looks like they can do whatever they want to your computer after signing up...
Hulu collects personally identifiable information in order to establish and enhance our relationship with you.
Enhanced? For who?
Downloads. In order to participate in certain Hulu Services, you may be notified that it is necessary to download software or other materials or agree to additional terms and conditions. Unless otherwise provided by these additional terms and conditions, they are hereby incorporated into these Terms.
All pretty standard fare for today's world though, so unless you've ever heard of a Corporation taking unfair advantages of people... I wouldn't worry!

If i visited a website that has been hacked by Turkis Hackers is there a security risk for my computer and online accounts?

If i visited a websited that has been hacked by Turkis Hackers is there a security risk for my computer and online accounts?

Try to rename the cert8.db file in the Firefox profile folder to cert8.db.old or delete the cert8.db file to remove intermediate certificates that Firefox has stored.
If that helped to solve the problem then you can remove the renamed cert8.db.old file.
Otherwise you can rename (or copy) the cert8.db.old file to cert8.db to restore the previous intermediate certificates.
Firefox will automatically store intermediate certificates when you visit websites that send such a certificate.
If that didn't help then remove or rename secmod.db (secmod.db.old) as well.

What are the security risks for opening port 80 on workstations?

Hello all,
in our environment, there is an application which open port 80 on workstations when installed, but it is not allowed on preimeter FW
could you please advise what are the security risks for leaving port 80 opened on the workstations? or it is considered secure unless it is not allowed on the preimeter FW?
thanks alot & regards

Hi R.Naguib.
The 80 port is open by default through the firewall on Windows system, it is used by a http protocol by a browser.
As for the network or hardware Firewall settings, I suggest to turn to the network administrator for details.
Regards
Wade Liu
TechNet Community Support

On mozilla's OWN WEBSITE I get the message 'Your Firefox is out of date and may contain a security risk!" but I just download and installed the latest version?

I have the latest version of firefox to date (10/15/2014 v32) and I still get messages while on various websites (Youtube, Google, Gmail) telling me that Your Firefox is out of date and may contain a security risk.
I even get that message on the support pages of mozilla.org??
I've tried the about:config reset the useragent(s) fix but that doesn't work.
I've tried browsing in safe mode and still get the error.
Why is this False/Positive happening?
Thanks

hello your useragent (the information the browser sends to websites to identify its version) - apparently mistakenly - shows this:
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20140923 '''Firefox/4.0.0; xs-A30GTmfXR3o;CkHZPf;'''
probably some sort of unwanted software has overwritten it. please refer to this article in order to reset the user-agent settings in firefox:
[[Websites say that Firefox is outdated or incompatible even though it's the latest version]]
in case this does not help, please try to reset the whole browser:
[[Reset Firefox – easily fix most problems]]

Which security risks can be exploited bij opening a routed port on a windows network

Which security risks can be exploited by opening a routed port on a windows network
Our company is implementing a web application with potential security issues we have never dealt with before. The situation is
as follows:
Network
•A LAN with internet router and firewall with a port (f.e. 4589) open, which is routed to IIS server address.
•Network with IIS server, Windows clients and server(s)
•MSSQL application Database on a windows client or server
•IIS Server hosts a .NET 4.0 WCF Web service
Purpose of this config:
•Internet users can use IIS web service to read and write application database tables.
•IIS server has a certificate for authenticity, web services are configured to only use https.
•Application exposes 2 web services:
•1. without user authentication: can only read non-essential information from database
•2. with user auth., for reading and writing more essential information.
I have the following questions concerning security:
1.Can I Isolate external access to the IIS server only, and shield access to the rest of the physical (windows) machine ?
2.We have a lot of customers with only 1 windows 7 or 8 PC. What extra security risks arise in case of a combined MSSql Express
database, Windows integrated IIS 7 or 8, and a customer doing its daily business on the windows client on this PC. (Daily business involves: use of our application (with database), Email, Office, Internet)
3.Can you see any other security vulnerabilities in this scenario, assumed that all machines in the LAN are properly patched ,
shielded with antivirus product and maintained?
Since security is not really my field of expertise, I would be very happy to get some explanation on potential risks of this
configuration.
Thanx in advance, Oskar Stok
Thanks in advance. Sincerely, Robert Bakker Flexdata

Hi,
1.Can I Isolate external access to the IIS server only, and shield access to the rest of the physical (windows) machine ?
You can configure Windows Firewall rules based on ports.
2.We have a lot of customers with only 1 windows 7 or 8 PC. What extra security risks arise in case of a combined MSSql Express
3.Can you see any other security vulnerabilities in this scenario, assumed that all machines in the LAN are properly patched ,
Honestly, I don’t see vulnerabilities here, if you want to secure the server and clients, place them in a private network, you can also use NAT and hardware firewall.
In addition, you can install System Center Endpoint Protection to prevent virus and spyware.
More information for you:
Configuring Firewall Rules
http://technet.microsoft.com/en-us/library/dd448559(v=WS.10).aspx
Frequently asked questions about malicious software
http://technet.microsoft.com/en-us/library/ff823783.aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Is this a security risk???

Hi,
Earlier today I was Googling dog breeds on Safari on my iPhone as we are thinking of getting a puppy.
I chose one particular site (that seems like a legitimate dog lovers website), but when I clicked the link instead of going straight to the site, a block of text about certain pills (it seems if I type the word my post if forbidden from loading and gets deleted).
The page with the paragraph only appears for a moment and the site loads.
It isn't a new tab or window, but it appears in the same page.
It only showed when the link was clicked, but not if I just clicked the back or forward button.
I've cleared the history and cookies.
It hasn't happened on any other site.
Does anybody know what this is?
Is this a security risk or just an invasive, but ultimately harmless, attempt at advertising?
Regards.

Hi Thomas,
Thanks for the input.
I think you mean sites where the advert appears and you are often given the option to skip.
However, the cheap layout, the speed with which it passed and, basically, the nature of the type of product are what put me on alert.
It may have been just a cheap advert (as it passes so quickly I only ever saw the first line) however that product it often associated with spam and the likes so I wanted to check.

Is knowing a user's SID a security risk?

If a SID of a user was in plain text on a PC (say a text file), would that be a security risk?

This is kind of a complex question? But if you can pull the AD useraccount SID's with a simple WMIC command with "domain user" -security group rights. So I would say that If someone can access the machine with user rights and get this information
its not a huge risk?
Yeah, I just wanted to double check. I mean a user name is a friendly conversion from the SID (much like a DNS name is to an IP address), right?

Possible Security Risks

Similar Messages

Maybe you are looking for