Kudos to SOC team.
7
Tag-100 Hacker Group Exploiting Citrix NetScaler & F5 BIG-IP Vulnerabilities
(cybersecuritynews.com)
CrowdStrike report of the incident: https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/
Well, depends. If the user go to a captive portal to "authenticate" before the VPN could closes, than no. But, if the VPN can "pierce" through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.
Interesting. I didn't know that syncthing does hole punching.
From a defense perspective, how would this work with an enterprise firewall, with UDP/TCP only allowed to specific destinations or specific sources. Example: only the internal DNS relay server can access 53/UDP and only the internal proxy server can access 80/443. What I mean is in a network with a very closed firewall, how would Syncthing be able to connect with peers?
Instance Rules
Be respectful. Everyone should feel welcome here.
Not necessarily. Torrent is a way to find a peer for direct connection or via a relay (of course that is more than that). Syncthing, even using a relay server, requires some ports available for at least outbound connection (22000 TCP/UDP or whatever port the relay is using). This should not be possible in a medium security network, let alone a defense network. I don't know if syncthing works without a direct connection (to the peer or relay, something like transport via http proxy).
Honestly, I didn't think about vulnerability in SyncThing when I read the article. But I wondered why defense forces would have p2p open on their networks.
By the messages that they are sending to customers, looks like is related to recent updates to the services, but nothing clear.
view more: next ›
Depends of the country. Disrupt with Internet/communications may be a crime in some countries.