IBU

Consol

Net Security Notes

http://www.berklix.com/~jhs/txt/net_security.html

by Julian H. Stacey

Bad / Evil USB & Firewalls

• www . zdnet . com / article / this - usb - firewall - protects - against - malicious - device - attacks /
• gizmodo . com / for - true - cyber - security - using - a - usb - firewall - is - essent - 1792986118
•   German: www . heise . de / ct / ausgabe / 2017 - 18 - Gefahr - durch - angriffslustige - Hardware - 3800729 . html
  English translation by google from original heise.de site
  translate . google . com / translate ? hl = en & amp ; sl = de & amp ; tl = en & amp ; u = https % 3A % 2F % 2Fwww . heise . de % 2Fct % 2Fausgabe / 2017 - 18 - Gefahr - durch - angriffslustige - Hardware - 3800729 . html
• FreeBSD:
  • lists . freebsd . org / pipermail / freebsd - usb / 2017 - September / 014939 . html
  • www . berklix . com /~ jhs / src / bsd / fixes / FreeBSD / src / gen / sys / dev /usb/usb_hub.c.REL=12.0-CURRENT.diff
  • https://lists.freebsd.org/pipermail/freebsd-usb/2014-October/013304.html
• Public Source based USB Firewalls give the satisfaction of being examinable, some maybe be based on Raspberry Pi - See also link to OpenWRT

Port Scanners

• https://en.wikipedia.org/ wiki/ Port_scanner
• Ports List by: Wikipedia & colasoft.com
  0-1023: well known system ports; 1024-49151: registered ports; 49152-65535: dynamic and/or private ports.
• netstat -nltu
• /usr/ports/security/   gtkportscan
  in 9.2-RELEASE but not in current/, command-line and GUI port scanner
  graphical version shows default ports as start=1, stop=1024 (seems wrong, I'd expect 0-1023)
• /usr/ports/security/nmap; nmap -Pn p________.dip0.t-ipconnect.de
  Needs Root. Does not work (at least by default) from a jail.
  (Maybe later I will take the IP number shown by Apache's http://www.berklix.net/ cgi-bin/ printenv & feed it to a similar wrapper calling "nmap -Pn $REMOTE_ADDR_or_REMOTE_HOST" [ maybe password locked &/or with a sleep to avoid 3rd party abuse ] ? - maybe something better exists ? comment welcome)
• /usr/ports/security/portsentry A responder
• http:// www.thinkbroadband.com/ tools/ dnscheck.html
  rec. by abuse@telekom.de 2015-01-01
• http:// grc.com/ intro.htm ... ShieldsUP
  Suppresses sub page URLs.
• http:// www.acunetix.com/ free-network-vulnerability-scan/
  Collects Email & Tel. No.
• http:// www.portchecktool.com/ ports.php
•   ShadowServer
  • https:// www.shadowserver.org/ wiki/ pmwiki.php/ Involve/ GetReportsOnYourNetwork
  • https://en.wikipedia.org/ wiki/ Shadowserver
  • (@ 2015-02 Deutsche Telekom use Shadowserver)

Back Door Open Ports to Routers

• Port 161 (SNMP) : British Telecom's back doors to their routers
• Port 4567 (TRAM)
  • Verizon's back door to their routers.
  • British Telecom's back doors to their routers
  • http:// forum.kitz.co.uk/ index.php?topic=10819.0
  • http:// punj-technology.blogspot.de/ 2012_04_01_archive.html
  • https:// community.bt.com/ t5/ ADSL-Copper-Broadband-Speed/ port-4567-backdoor/ td-p/ 59703
  • https:// community.bt.com/ t5/ Other-Broadband-Queries/ port-161-open-on-home-hub-3/ td-p/ 133207/ page/ 10

Further Reading

• FreeBSD
  • /etc/rc.firewall
    • http://svnweb.freebsd.org/base/head/etc/rc.firewall?view=log
    • file:// /etc/rc.firewall
  • firewalls.html
    • http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls.html
    • file:///usr/local/share/doc/freebsd/handbook/firewalls.html
  • man divert(4), ip(4), ipfirewall(4), natd(8), protocols(5), reboot(8), services(5), sysctl(8), syslogd(8)
  • ipfw: sysctlbyname("net.inet.ip.fw.verbose_limit")
• BSD & Other Cautions
  • The IP filter list may not be modified if the system security level is set to 3 or higher (see init(8) for information on system security levels).
  • http:// www.wenks.ch/ fabian/ ADSL-PPPoA.html re MTU 1500& PPPoA, PPPoE
• Some Organisations
  • http:// www.pfsense.org/
  • http://www.cert.org
    ftp://ftp.cert.org/pub/tech_tips/packet_filtering
  • Chaos Computer Club
    (if link fails from Britain, CCC wrote 2014-12-05 "A significant portion of British citizens are currently blocked from accessing the Chaos Computer Club's (CCC) website" So try http://213.73.89.123/.
    CCC also linked to here.
  • Free Software Organisations
• Books
  • Book:
    • Title: Building Internet Firewalls, Authors: Brent Chapman and Elizabeth Zwicky Publisher: O''Reilly & Associates, Inc, ISBN: 1-56592-871-7
    • http://www.ora.com/
    • http:// www.oreilly.com/ catalog/ fire2/
  • Book:
    • Title: Firewalls & Internet Security - Repelling the wily hacker. Authors: William R. Cheswick, Steven M. Bellowin, Publisher: Addison-Wesley, ISBN: 0-201-63357-4
    • http:// www.awl.com
    • http:// www.awlonline.com/ product/ 0 %2C2627 %2C0201633574 %2C00.html