#Firewalls

Kevin Karhan :verified:kkarhan@infosec.space
2025-05-04

@torproject Q: I wish there was a similar tool test #Bridges, as bridges.torproject.org/scan/ is not that good and I don't want to hammer it with dozens of addresses, cuz at best that's quite antisocial if not possibly trigger responses assuming this is an intelligence gathering operation.

  • Ideally sone standalone binary that one can just give a list of #TorBridge|s in a text file (similar to the way one can just past them in at #TorBrowser) would help.

I.e.

bridgetest -v4 obfs4 203.0.113.0:80 …

bridgetest -v6 webtunnel [2001:DB8::1]:443 …

bridgetest -list ./tor.bridges.list.private.tsv
  • But maybe #onionprobe already does that. In that case please tell me to "#RTFM!"

Similarly there needs to be a more granular way to request #TorBridges from #BridgeDB (as it's basically impossible to get #IPv4 #Webtunnel addresses nor is there an option to filter for #ports like :80 & :443 to deal with restrictive #firewalls (i.e. on public #WiFi)…

  • there are flags like ipv6=yes but neither ipv4=yes nor ipv6=no yielded me other resultd than #IPv6 webtunnel bridges…

And before anyone asks: Yes, I do have a "legitimate purpose" as some of my contacts do need Bridges to get beyond a mandatory firewall and/or do use #TorBrowser (through an #SSH tunnel) to circumvent Tor & #VPN blocks and maintain privacy (as many companies do block sometimes entire #Hosters' ASNs due to rampant #scrapers

MrsNo1SpecialMrsNo1Special
2025-04-29

Behavioral firewalls are quietly taking over as the digital sentinels of modern cybersecurity architecture. Unlike traditional firewalls that act like bouncers blocking known threats at the gate, behavioral firewalls operate more like surveillance analysts — tracking, interpreting, and...

medium.com/@mrsno1special/beha

#

Kevin Karhan :verified:kkarhan@infosec.space
2025-04-25

@adisonverlice I think that's dangerous disinfo as @torproject actively works against attempts to fingerprint and track #Tor users.

  • I do consider Tor more private than any #VPN simply becaise they can neither ban users nor identify them.

In fact, Tor has been designed with the explicit goal to circumvent #Firewalls and #InternetCensorship methods like #DeepApcketInspection.

As a matter of principle I'd never vouch for any #centralized, #SingleVendor and/or #SingleProvider solution of any kind, including #Session.

  • Tor is sufficiently decentralized in that it is not only completely #OpenSource but has proven to not have SPOFs in the form of maintainers and is able to yeet proplematic folks (unlike #WikiLeaks!)…
isecjobs.cominfosec_jobs
2025-04-24

HIRING: Deputy Director, Physical & Cyber Security / San Jose, California
💰 USD 208K+

👉 isecjobs.com/J882697/

Kevin Karhan :verified:kkarhan@infosec.space
2025-04-24

@k4m1 @stman yeah, according to the #RTL8139 #datasheet this is basically a very cheap 10/100M NIC designed #embedded systems and low-end/low-cost desktops, and for a device designed and sold in 2006 it made sense, given back then #Gigabit-#Ethernet and Cat.5 cabling was considered high-end.

  • And unlike contemporary / successor chips by #Intel like the famous #i210 (which is still offered as #i219 but mostly succeeded by the #i225 as a 2,5GBase-T version) is way cheaper, which pre-#RoHS - NICs being sold for like € 10 retail & brand-new....

The few issues known only affect like #Virtualization setups, a market this thing was never designed for (most likely also never tested against).

  • I'd not he surprised if a lot of cheap #ThinClients and other systems used these NICs because of the simplicity of integration, being a cheap 3,3V single-chip (+auxilliary electronics) solution and propably costling less than 10¢ on a reel of 10.000.

It's the reason why to this day we see #Realtek NICs being shipped instead of fanning-out & enabling #SoC-integrated NICs with a #MAC & #PHY instead: Because the auxilliary parts for those are more expensive than just getting a PCI(e lane) somewhere and plonking it down.

  • Maybe there have even been some really cheap, low-end #Routers / #Firewalls aiming at #SoHo customers back in those days, cuz back then 16MBit/s #ADSL2 was considered fast, and Realtek's NICs up until recently only delivered like 60-75% of the max. speed advertised, so by the time someone would notice, that gearvwould've been EoL'd anyway and those who did notice right-away never were the target audience to begin with.

Most modern NICs are more complex and demand more configuration / driver support...

2025-03-25

Sorry I've been quiet. Double whammy kept me from posting today. Flood loss tax return and OpenWRT firewalls - not sure which one was worse. #death #taxes #firewalls

isecjobs.cominfosec_jobs
2025-03-25

HIRING: Deputy Director, Physical & Cyber Security / San Jose, California
💰 USD 208K+

👉 isecjobs.com/J806992/

2025-03-06

OK I figure I should update this, since I got a reply from Vermont: they weren't blocking #LibreWolf. A bit more searching and it looks like #firewalls don't get along well with OCSP servers (unless otherwise configured), and LibreWolf enforces an OCSP check by default.
I've turned off the setting ("Enforce OCSP hard-fail" under about:preferences#librewolf) and I'll let y'all know if that worked next time I use the campus WiFi.

2025-02-20

#PaloAlto #Firewalls Under #Attack As Miscreants Chain Flaws For #Root Access - Slashdot

A recently patched #PaloAltoNetworks #vulnerability (CVE-2025-0108) is being actively #exploited alongside two older flaws (CVE-2024-9474 and CVE-2025-0111), allowing attackers to gain root access to unpatched firewalls.
#firewall #security

it.slashdot.org/story/25/02/19

Rene Robichaudnerowild
2025-02-10
2025-02-05

Joint Publications Focus on Mitigation Strategies for Edge Devices > NSA/Central Security Service

FORT MEADE - The #NSA has joined the Australian Signals Directorate’s Australian Cyber #Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), & others to release 3 guides #Cybersecurity Info Sheets (CSIs) that highlight critically important mitigation strategies for securing edge device systems, including #firewalls, routers, & #VPN gateways.

nsa.gov/Press-Room/Press-Relea

privacy_guruprivacy_guru
2025-01-29

I panicked but I never did find out what it was. I learned how to reinstall and started from scratch. I began to use -virus and and I began to learn about computer security so as to avoid getting infected by something again. Then the fad hit and I used tools like -Aware to scan my computer and those of friends and loved ones. I think the most spyware/adware I saw was over 1,000 detections on one computer. Then the threat landscape changed again.... 2/4

LBHustonlbhuston
2025-01-24

Since we can analyze all of your firewalls, routers, switches and other network devices simultaneously, we can also ensure that your security posture is consistent everywhere you have a presence!

Read more 👉 lttr.ai/AatZ3

@infosec_jcp 🐈🃏 done differentlyinfosec_jcp@infosec.exchange
2025-01-17

Let's hope 2025 will bring back the popularity of #StatefulFirewalls for the mobile space once again.

#infosec #Firewalls #mobile

2025-01-17

How do you deal with the problem that a new security product is "sexy" and gets management support, but actually operating, maintaining and doing security rule tightening is "operational" and never gets any management visibility, resources or prioritization?
#firewalls #cybersecurity

2025-01-15

Extraction Agent and Firewall: Software vs. Hardware

Using a firewall is essential to secure the installation of the extraction agent when performing low-level extraction from a variety of iOS devices. We developed two solutions: a software-based firewall for macOS and a hardware-based firewall using a Raspberry Pi (or similar microcomputer) with our own custom firmware. This guide will help you choose the best option for your needs. Before we go any further, let us clarify that the solutions described in this article are neither traditional […]

whalers.ir/blog/extraction-age

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst