Will Heather Morris' Hacker Go to Jail for Naked Photo Leak?

Another one of my fave stars, Heather Morris, has had her cell phone hacked. Will we finally see one of these hackers go to jail? ?Laurent, Canada, via the inbox Indeed,...

house assessment career placement tests class assessment

The Dangers of Open Web Management UIs

When you buy an enterprise product, you almost assume nowadays that its management interface is going to be via a Web browser to a built-in Web server on the device. This trend began almost as soon as the graphical Web was available in the mid-1990s, and today almost no one writes their own front-end management software. Well, that is both a blessing and a curse, as the folks from the InfoSec Institute have recently reminded me in their post here this week.

Sponsor

"Under no circumstances should these [Web interfaces] be open to the world and the Internet," writes the author of the post, using a pseudonym. He goes on to cite a few egregious examples. The issue here is that someone can enter your network without upsetting any of your perimeter defenses, and this someone can use common search tools to find open interfaces using Google and shodanhq.com, a search engine specifically designed to locate web-connected devices. A quick search for open WatchGuard firewalls brings up more than 4,000 of them, for example.

Here is an example of a Cisco router that is open to the Net:

In the referenced blog post, the author shows numerous other examples of ways that hackers can access these open interfaces. Now, you'll still need to figure out an admin user name and password, but in many instances people just use the default values, making these devices even more insecure.

So what can you do to beef up your Web UI security? Here are several suggestions:

• Disable any optional Web UI if not required. Use SSH if available. Better yet, require that all management happen from a specific PC that is kept in a secure location.
  
• Restrict access to the Web UI by IP address range or to specific admin IP addresses.
  
• Restrict access to the Web UI by VPN and keep the device accessible only by private IP on the LAN side of its ports.
  
• Use a good password. At the very least, use a 26 or longer character passphrase or password for critical network devices. Change it regularly.
  
• Disable telnet on any Cisco devices, even if the device is only accessed internally.
  
• Enable brute force prevention or rate limiting. Every layer of security helps.
  

Discuss

thinklink assessment rule 25 assessment air traffic controller career

Happy Birthday, Hottie! Ryan Gosling Turns 31

Like a fine wine, Ryan Gosling just gets better with age. The actor, who hits 31 today,�has had himself quite the breakout year since he turned 30. What were his...

fitness assessments math rubric examples shared assessments

Mika Edin Our Most Turquoise Friend

Bellows has a gnarly new video from Euro ripper Mika Edin called Our Most Turquoise Friend.

education and training career cluster georgia writing assessment career ability placement survey

Snooki and Jessica Simpson: How Much Money Will They Make Off of Their Babies?

I gotta know: How much can stars like Jessica Simpson and Snooki make off of their babies these days? Are they earning more than their day jobs by selling out their fetuses? ?Your...

property assessment value vocational interest inventory network assessment checklist

EPA Out to Raise Your Electricity Bill

holland career assessments in education marie clay observation survey

Bobbi Kristina Brown Reportedly Cast In Tyler Perry?s ?For Better or Worse?

For the past few weeks, we’ve been hearing about Bobbi Kristina‘s romantic relationship with her “pseudo brother” Nick Gordon but today we get to hear some very positive BK news. It is being reported that Bobbi Kris has been cast in a recurring role on the Tyler Perry TV series For Better or Worse. Now, [...]

career cluster survey career pathway writing assessments