15
submitted 5 hours ago by [email protected] to c/[email protected]
9
submitted 5 hours ago by [email protected] to c/[email protected]
18
submitted 9 hours ago by [email protected] to c/[email protected]
41
submitted 10 hours ago by [email protected] to c/[email protected]
25
submitted 1 day ago by [email protected] to c/[email protected]
10
submitted 1 day ago by [email protected] to c/[email protected]
4
submitted 1 day ago by [email protected] to c/[email protected]
5
submitted 1 day ago by [email protected] to c/[email protected]
44
submitted 2 days ago by [email protected] to c/[email protected]
7
submitted 2 days ago by [email protected] to c/[email protected]
22
submitted 2 days ago by [email protected] to c/[email protected]
29
submitted 2 days ago by [email protected] to c/[email protected]
[-] [email protected] 2 points 1 week ago

Interesting. I didn't know that syncthing does hole punching.

From a defense perspective, how would this work with an enterprise firewall, with UDP/TCP only allowed to specific destinations or specific sources. Example: only the internal DNS relay server can access 53/UDP and only the internal proxy server can access 80/443. What I mean is in a network with a very closed firewall, how would Syncthing be able to connect with peers?

[-] [email protected] 11 points 1 week ago

Instance Rules

Be respectful. Everyone should feel welcome here.

[-] [email protected] 6 points 1 week ago

Not necessarily. Torrent is a way to find a peer for direct connection or via a relay (of course that is more than that). Syncthing, even using a relay server, requires some ports available for at least outbound connection (22000 TCP/UDP or whatever port the relay is using). This should not be possible in a medium security network, let alone a defense network. I don't know if syncthing works without a direct connection (to the peer or relay, something like transport via http proxy).

[-] [email protected] 6 points 1 week ago

Honestly, I didn't think about vulnerability in SyncThing when I read the article. But I wondered why defense forces would have p2p open on their networks.

[-] [email protected] 3 points 4 weeks ago

By the messages that they are sending to customers, looks like is related to recent updates to the services, but nothing clear.

[-] [email protected] 1 points 1 month ago

IoCs available in the original article.

[-] [email protected] 17 points 1 month ago

Please note that the attack can only be carried out if the local network itself is compromised.

[-] [email protected] 1 points 1 month ago

IoCs available here. Some of them with no detection on VT.

[-] [email protected] 0 points 1 month ago

MS involved. Again.

[-] [email protected] 2 points 2 months ago

Of course, in the end it is just conflict, and when it spills over into the real world then you have a war. But this is not always the case We have already had disruption in power grids, nuclear plants, hospitals, public offices, critical infrastructure of financial markets (some of them with impact in real lives) without retaliation in the physical world.

Cyberwar, in my perspective, have some nuances. For instance, in a physical conflict, a hostile nation's invasion of my property immediately becomes a state issue. However, this isn't always the case in a cyberwar if a hostile state invades my organization (It's hard to immediately distinguish whether the actor is a nation state, a financially motivated group, hacktivists, or just a guy who eats pizza in his mom's basement). Most of the time, organizations are on their own.

In a cyberwar, espionage is also far more acceptable. This is something the NSA (and FSB/SVR) has been doing for years (against private entities and states). In a way, I understand that it is something similar to what the cold war was (is), but with no boots on the ground.

[-] [email protected] 2 points 2 months ago

I'd better say that states have been doing this.

view more: next ›

kid

joined 4 months ago
MODERATOR OF