• Activity
  • Votes
  • Comments
  • New
  • All activity
    • Showing only topics in ~comp with the tag "infosec". Back to normal view / Search all groups

    3. How reliable is IP ownership information?

      Ask
      I have interactive firewalls like OpenSnitch running on most of my desktop OS's. I like to see what is going on with my machines' network connections to learn about networking, infosec, and to...

      I have interactive firewalls like OpenSnitch running on most of my desktop OS's. I like to see what is going on with my machines' network connections to learn about networking, infosec, and to have have some peace of mind.

      Example workflow:

      1. Get a firewall notification of a new incoming connection to some process running on my machine
      2. If no DNS entry exists and only the IP address is provided, then I google the IP
      3. I find something like https://ipinfo.io/74.125.20.189
      4. I make a decision as to whether allow/deny based on the ownership info which I found in step 3.

      Aside from trusting the particular site presenting the ownership info, how reliable is this information regarding IP ownership?

      For example, if an IP came back as "Google" could it really be a GCP instance running a command and control server?

      Another example, I know that large corps own big blocks of IPv4, but they must lease these IP's out to whomever, right? I imagine there is some wild-west market for these with little accountability?

      Are either of these scenarios realistic? If so, is my entire workflow for "do I trust this IP" pointless?

      edit: btw, I used to catch and deny incoming connections from *.ru to the Windows legacy Skype client all the time. I cannot think of any non-evil reason why that should have been happening. That particular series of events is what really validated me doing this. If you can think of a non-evil reason for any incoming connections to skype from *.ru, please let me know.
      5 votes

    6. Seeking recommendations for infosec podcasts

      Ask (recommendations)
      I have been listening to "Darknet Diaries" and it's a great podcast, but I am looking for more. Maybe more technical. Does anyone have any good recommendations? Thanks! Edit: if you are like me,...

      I have been listening to "Darknet Diaries" and it's a great podcast, but I am looking for more. Maybe more technical.

      Does anyone have any good recommendations? Thanks!

      Edit: if you are like me, and learning about this stuff, here is an interesting and hilarious episode of mini-stories from Darknet Diaries: https://darknetdiaries.com/episode/22/

      8 votes

    8. Does anyone here work in infosec? If so, which laptops are you allowed to use?

      Ask (survey)
      I’ve recently gotten to speak with a few folks who work at an enterprise security company. I asked what their security researchers set as company rules for allowed laptops. My one datapoint so far...

      I’ve recently gotten to speak with a few folks who work at an enterprise security company. I asked what their security researchers set as company rules for allowed laptops. My one datapoint so far is “Dell or Apple.” So for example, no Thinkpad X1 Carbon, which is arguably the best work laptop.

      I am curious what other large security companies (or any of you security minded folks) set as rules for trusted laptops. Can anyone share their lists and theories as to why I heard Dell and Apple? BIOS is more trustworthy?

      10 votes