How do I inform a company I found a leaked database of theirs on the Internet?

Recently I found a leaked database of a company and I do not know how to go about contacting the company. It is so weird because I cannot find any type of Information Security contact email to report this to. It just has a support email. I feel uncomfortable sending the link to the support email.

Should I ask for an Information Security email contact from that company or what should I do? By the way, the support email for the company is more of a fraud or customer support email not a technical support or security.

Also, what would be a good template to follow to give the best insight of the leaked database?

Why can I access the internet with all ports closed on firewall?

For the heck of it I wanted to see how much I could close down my router from the rest of the internet. I was hoping turning on the firewall, removing any port forwarding and turning off UPnP would make me unable to even browse the internet. However, my PS4 still had a connection when trying it out, also any internet browsing also worked.

What am I missing here? How can ports 80/443 be open for web traffic? Also, the PS4 that requires a bunch of ports to be open still worked. Is it because the request is coming from inside my LAN that it opens these ports temporarily?

Thank you.

Has a recent patch disabled TLS1.2 and/or RSA on Internet Explorer?

Our office intranet has from today started refusing access from Internet Explorer 11 (necessary as it uses plugins) to a certain page. The error I get in IE is in Japanese, but talks about old TLS versions. If I look at the page with Chrome, on the Security page

Connection – obsolete connection settings

The connection to this site is encrypted and authenticated using TLS 1.2, RSA, and AES_256_GCM.

RSA key exchange is obsolete. Enable an ECDHE-based cipher suite.

I know that the deprecation date for TLS 1.2 has been extended due to COVID-19, but a recent patch seems to have fixed CVE-2020-1118, but in the process might it have broken something else? Note, I do allow TLS 1.2 connections in IE.

Does routing internet traffic via VPN through a company proxy gain any more security?

There is currently an ongoing discussion in our company about what security measures to put in place regarding workstation access to the company network and the internet.

Situation:

  • Employees have Linux laptops with encrypted SSDs
  • on these SSDs is the intellectual property of the company
  • Employees have unrestricted root access to these machines
  • AntiVirus is installed and running

Goal:

  • Have protection against theft of the intellectual property of the company while still being able to work from anywhere in the world

Current idea:

  • Use VPN to tunnel all network traffic (including internet traffic) through the company
  • Do not allow direct internet access via VPN but rather enforce that a proxy server has to be used.

Question:

Does the additional proxy server for internet access provide more security than it (potentially) costs in the effort? (additional client configuration effort programs and services, …)

Laptop <-> VPN <-> Proxy <-> Internet vs. Laptop <-> VPN <-> Internet

Brainstorming:

If the laptop is compromised (backdoor running). How does VPN protect the data anyway if the user has root access and can change network configuration (routes, iptables, …) as he pleases. What additional security does a company proxy give?

How do I run a game of Dread over the Internet?

The challenge is finding a suitable substitute for The Tower. For those that don’t know: Dread is a horror game that uses a Jenga tower instead of dice. The tower is shared among the players. Successful pull is success. Toppling the tower is (usually) death of the character.

I’m looking for a Jenga-like game and some mechanism for the players to take turns and for everyone to see the game’s progress in real time. The game should be an open ended one of dexterity (with keyboard or mouse) that becomes progressively harder over about 20 to 40 short levels till failure is almost certain but not guaranteed.

Simple and Universal way to password-protect existing webservices that are exposed to internet

There are many tools, devices and programs that by default run a http server and expose a user interface on port 80. Even my coffee machine has a web ui that it provides on port 80.

Now, it’s easy to make these existing webservers available through the internet by simply doing port-forwarding on the internet facing NAT.

I want to do this, but I want to password protect access to them in a simple, generic and secure way.

On simple way would be to just NOT expose them and access them only through a VPN connection. Currently I’m doing this – but I want to be able to access the services without a vpn tunnel from anywhere in the web.

So, let’s say I have three http services in my Lan that I locally can access on

CoffeeMachine:80 MyLightSwitch:80 ToiletFlush:80 

Now I want to be able to access them over the internet by going to

http://mystaticIP/coffeemachine http://mystaticIP/lightswitch http://mystaticIP/toilet 

But for all of them, I want that they are ONLY accessible after some form of user-password authentication.

I don’t need individual users/passwords for the different servers. Can be all the same.

What’s an easy but yet secure way to expose all these three services to the internet, without having to tamper with the http servers on these devices themselves? (by secure I mean that without knowing the password it won’t create a trivial security hole. I don’t worry about man-in-the-middle attacks or so).

Tools I have available to solve this:

  • Adding an additional server running any linux distro/services to the local network
  • Set portforwarding on my NAT

Is there any way to hide my using the internet (or maximize privacy) when connected via router to other computers?

I shall begin my question with the remark that I am not tech savvy at all!

The problem is the following:

A cluster of computers (laptops, desktops, etc.) A, B, C, D… are all connected to the same router. Let’s say my computer is computer A and I am a guest at big brother Bob’s home, who owns the router and computers B, C, D…

Assuming Bob has no physical access to my computer but can access the other computers, is there a way to prevent Bob from knowing what I am doing on the internet, or even better, to completely hide from Bob that I used internet at all? (short of his contacting his ISP and demanding a report or something which would take a non-trivial amount of time and assuming I don’t download anything or watch HD videos which could show up as a sudden spike of consumption)

When it comes to hiding the names of websites I visit and internet searches, according to some research it seems like Tor does a good job in hiding it completely, even if the ISP is contacted. However, can Bob determine quickly (i.e. without contacting his ISP, using some cmd dark arts) that computer A has connected to a Tor node at all without physically accessing computer A? (Let’s say it’s not in the cluster anymore when Bob does his checks)

According to further research it seems to be impossible to get the internet history of all connected devices to a router without access to the devices, but I am unsure and opinions seem to vary somewhat.

TL;DR I’m basically looking for a way to make my internet usage as inconspicuous as possible during a very specific time period when indirectly connected to other computers via a router I don’t own, is using Tor the best thing I can do in this situation to maximize privacy?

Thank you.

What exactly determines which entities/servers “on the Internet” get to read my e-mails when I send them from X to Y?

Let’s say, for example, that I have a Gmail account. I compose and send an e-mail to info@somecompany.com. They aren’t using Google services, just so that we can exclude “special cases” where they just keep the entire thing internal to their own network.

On a technical level, doesn’t the e-mail client/software just look up somecompany.com’s MX records and then connect directly to that IP address on the “e-mail port” and, assuming it is online and accepts the “handshake”, just transfers the e-mail directly to it?

Why have I heard all my life that e-mails just get “flung out in cyberspace randomly” and bounced around the entire world, allowing everyone and their grandmother to read it before it finally gets routed to its final destination?

Is this a total misconception? Was it something that was done in the 1960s because they couldn’t afford to have computers on at all times, so they had to do it like this? Is it by design in order to allow spying?

I feel ashamed for still not having a good grasp on this after all these years. I’ve probably tried to ask about this dozens of times over the years, but never got what I considered a clear and conclusive answer.