Detection is the act of discovering and/or determining the existence, presence, or fact of something.

learn more… | top users | synonyms

0
votes
2answers
33 views

Spam mails originating from botnet

Background I am working on spam detection at the receiver side,i.e where all mails are delivered,i.e at the mailserver side. Spammers are capable of sending spam mails through Bots,Open relays and ...
1
vote
2answers
65 views

Risks in avoiding AdBlock detection by importing cookies or simulating the displaying of ads

I've increasingly been finding that many of the websites that I access have now been requesting whitelisting by my adblocker. Sites that do this like Forbes, NDTV, do not allow you to proceed until ...
1
vote
1answer
29 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
0
votes
1answer
52 views

How to check how I was hacked? [duplicate]

Today I was notified by DigitalOcean that my droplet was hacked and a DDOS attack was generated from it. It was a droplet I used as a staging server for a webapp I will send to production later, and I ...
1
vote
0answers
32 views

Detecting disabled Chrome plugins using JavaScript

My cable was on the fritz this weekend and I had to visit a friend to watch HBO online. Something weird happened that has been bothering me. I have disabled the Flash plugin on Chrome, since all ...
2
votes
1answer
54 views

Can multiple transactions of the same amount in a short time be considered fraud/corruption?

Back story In South Africa there is a website where I can buy prepaid electricity online for my apartment. When buying I did not get the token to use on my metered box. I had a chat with them today ...
2
votes
2answers
99 views

Finding a backdoor on a server?

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices. The ...
1
vote
1answer
47 views

is browser the only app that can set supercookies?

I'm trying to identify a if a website uses tracking cookies beyond ordinary cookies, that get deleted when I click "Delete cookies". The work plan is to run a clean virtual machine, use a software ...
7
votes
2answers
77 views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
3
votes
1answer
169 views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
1
vote
0answers
41 views

circumventing cameras [closed]

We have Samsung wired cameras placed in 9 different places in the home. Somehow they are being circumvented and a laser doesn't seem to be the way it is happening as bright flashes do not appear on ...
2
votes
1answer
63 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
1
vote
0answers
11 views

snort spp_sfPortscan Preprocessor Customization [closed]

I am working in snort 2.9.8.0. I want to modify the snort code for Portscanning Detection,i.e spp_sfPortscan.c and its related code to build a customized portScan detector. Ex:suppose A is scanning ...
21
votes
3answers
2k views

Would it be plausible to write your own anti-crypto-ransomware tool? [closed]

Question After reading about how basic ransomware targets and encrypts your files. I was wondering if it would be plausible to write your own script to try and detect such activities? Initial ...
2
votes
0answers
60 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
4
votes
1answer
62 views

Security monitoring in the cloud?

I am working for a company which works with PHI, HIPAA, PCI and other highest sensitivity data. Their current security architecture uses hardware network monitoring tools to monitor the network ...
1
vote
4answers
286 views

Fraud detection to avoid fake users

I know there is no 100% solution for fraud detection, but at least I want to set some level of confidence in this use case. Suppose that I have a system where: A user need to make a registration A ...
1
vote
2answers
472 views

Signal listening

Is there a way to know if someone listens to signal I produce (air signal as well as signal on network)? Is there a way to know if the signal was listened along the way until the signal is reached to ...
27
votes
4answers
2k views

Fake users in database for compromise detection

I have read of sites* adding fake users to their databases and then monitoring their usage. One of these fake users being used or even attempted login may mean database compromise etc. This sounds ...
3
votes
1answer
64 views

Detect a Virtual Machine on my Wifi?

Is there a way to detect whether a machine connected to my wifi is a physical machine or a virtual machine?
3
votes
3answers
143 views

Detection and monitoring of important events on OpenVPN server

If an attacker can establish a VPN connection to the company network and have access to internal resources (by getting various certificates and credentials used to authenticate to the VPN server), ...
5
votes
1answer
324 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
6
votes
2answers
387 views

Can network admin detect port scan on a certain host?

Say, my laptop is connected to a large WiFi network with many other users. If a port scan is run on my IP by somebody else on the same WiFi network, is it possible for the network admin (or anybody) ...
0
votes
1answer
106 views

Strange browsing problem, unknown images

When I open any site, I sometimes see unknown images replacing the original images on the website. They are not ads and can't be clicked. Just random images of people, cartoons etc. When I refresh ...
69
votes
11answers
6k views

Sanitize computer after Homeland Security seizure [closed]

I flew from overseas back to the USA and all my electronic equipment was seized by Homeland Security, including my laptop computer, external hard drives, flash drives, etc. After more than a month I ...
0
votes
3answers
163 views

If I connect to a website using a cellular network, and change the sim card and connect again with the same phone, will they find its the same phone?

I read on a blog that when you connect to a website with your phone they track the model number id of the device, or something like it. I don't remember what its called. Even if you change your sim ...
-2
votes
2answers
99 views

Unpredictability vs Predictability [closed]

Unpredictability and Predictability in security. I am tasked to come up on which is more important in terms of security, if possible, on cyber security. After reading through several articles on ...
2
votes
1answer
97 views

Effectiveness of Secure Boot on kernel-mode rootkit detection

With so many new patches and updates, how effect is Secure Boot on detecting kernel-mode rootkits?
0
votes
1answer
150 views

How to detect arp spoofing using iptable? [closed]

How can I set iptables to detect arp spoofing on linux?
6
votes
1answer
2k views

How does a website detect proxy? [duplicate]

How can a specific website detect that I'm surfing via proxy? Is there a way to use proxy and not get detected? If so, how?
-2
votes
2answers
114 views

Is it possible for a website, by knowing the public IP only, to detect the exact smartphone device I'm using?

If with the same smartphone device I surf to one website (each time with a different IP, different SIM card and no saved cookies or cache), is it possile to detect that I'm using the same device? If ...
2
votes
1answer
367 views

How can I hide a program from another program?

If program A scans RAM, running processes and whatever, can I hide program B from being detected by A? Basically, I don't want program A to detect program B, or at least, stop it from identifying ...
-1
votes
1answer
272 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
1
vote
1answer
294 views

What does the http_uri content modifier do is SNORT

I am very confused about exactly what http_uri does. Can someone explain this to me w.r.t NORMALIZED and UNNORMALIZED uri fields?
2
votes
1answer
95 views

Why do phishing sites use images instead of just copying the HTML?

Why do phishing sites use pictures of the full site (e.g., they took screenshot and broke it up) instead of just copying the real HTML and modifying the target for form submission of username/...
2
votes
1answer
3k views

How to simulate network attacks and use wireshark to detect them?

I am working on a project which involves me to simulate a network attack and to use wireshark to detect the attack. DOS/MIM etc. I have found the following links that provided help but there are still ...
0
votes
2answers
379 views

Detecting RDP on non-standard ports

How can RDP connections on the network be identified if they are no longer using TCP 3389 and instead using a non-standard port? If the administrator of a system changed the port for remote ...
5
votes
1answer
155 views

What is the proliferation of IMSI Catchers?

We know that IMSI-catcher detectors such as the Android-IMSI-Catcher-Detector project exist, but has anyone done a field study across various parts of the world as to how many there are and where? ...
1
vote
2answers
249 views

How can I detect unencrypted self-executing code in JPEG images?

Assuming that I have an infected image containing a self-executing malicious code that targets my image viewer and executes when I open the file. Supposing also that my computer is completely clean ...
1
vote
2answers
554 views

Malicious self-executing code can only exist in EXIF data in JPEG images?

Let's say we got an infected JPEG image that just by viewing it can automatically execute the malicious code stored inside it. It can do this either by taking advantage of the image viewer's security ...
0
votes
1answer
433 views

How to detect an image virus?

How can someone detect a malicious code, executable or not, inside an image file ? What techniques and what programs are out there that will help you for the detection procedure ? This question is a ...
0
votes
2answers
125 views

Detecting malicious domains/URLs [closed]

Do state of the art commercial URL threat intelligence feeds ( for example, one's by Symantec, Intel-security etc) miss malicious domains? (i.e. domains serving malware,exploit code & phishing ...
22
votes
2answers
3k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
1
vote
1answer
371 views

Detecting web app attacks by parsing log files [duplicate]

Following up on this question as the answers are now 5 years old: Can I detect web app attacks by viewing my Apache log file? My boss has tasked me with analyzing our access.log and error.log files ...
9
votes
2answers
1k views

Are there / have there ever been viruses that completely evade virus scanners for very long?

Are there, or have there ever been viruses that completely evade all virus scanners for a long time (e.g. longer than a year?)
0
votes
1answer
236 views

Signature Based Malware Detection

I am developing software for detecting malware based on signature, in Java. I have researched a lot for the approach to move ahead. I found that the basic idea is to store the existing malware ...
0
votes
1answer
123 views

DDoS Detection devices available in the market? [closed]

Wanted to know what DDoS detection devices are currently available in the market.My organisation has its dedicated firewalls and routers.But we wanted to know if there are any devices in the market ...
1
vote
0answers
59 views

Airgapped network security: feasable to prevent precompiled code from running to limit vulnerability to hacked firmware?

I'm not sure if this is the right medium to ask this but I'm looking for pointers or if this is being done. I realize that this is still a bit of a open question. When internal network holds critical ...
2
votes
1answer
452 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
0
votes
1answer
96 views

Integrity-Based Execution

Intrusion Detection Systems (IDS) rely on binary signatures or known-bad-behavior of malware in order to detect threats. It has become very clear that this approach has limited success due to the fact ...