The detection tag has no wiki summary.
2
votes
2answers
112 views
Is interpreted malware easier to detect than compiled malware?
Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
7
votes
1answer
83 views
Is there a public database of mutex names that are associated with malware?
I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
0
votes
0answers
157 views
Snort Parallelization Techniques and its effect on DDOS detection capability
I want to ask a query about snort parallelization.
1) Can snort detection rate remains same for all attacks after parallelisation?
2) As the parallelisation of netowrk traffic in each core is based ...
0
votes
1answer
66 views
Mechanisms to detect service abuse in the cloud
I want to ask if it is possible to detect the abuse of a service in the cloud. How can the SaaS provider be sure that the client does not use the service for criminal acts? For example how can Google ...
3
votes
2answers
141 views
Why some antiviruses detect viruses and some not?
I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
-2
votes
1answer
245 views
Foolproof Jailbreak detection? [closed]
I went through various posts which talks about jailbreak detection mechanisms. Whatever I came across is either something that apple would reject during the vetting process or something that could be ...
2
votes
2answers
155 views
Analyzing Network Anomalies for Malicious events
For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main ...
0
votes
0answers
21 views
Steganalysis of outgoing traffic [duplicate]
Possible Duplicate:
Detecting Steganography in images
Is there any commercial traffic monitoring systems that implements steganalysis and could issue a warning upon suspicious file transfer ...
1
vote
4answers
286 views
Are malicious scripts in batch files detected by antiviruses?
we have many scripts in shared folders in our IT Department.
Are malicious scripts in batch files detected by antiviruses?
1
vote
2answers
420 views
How effective is Windows Task Manager at identifying keyloggers?
I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick ...
3
votes
1answer
511 views
How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?
This is what I believe to be an interesting challenge :)
A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
2
votes
3answers
217 views
Repudiation in Copyright Infringement (BitTorrent)
Seeing this question : How did an alleged illegal downloading be detected? sparked a question I have had for a long time.
How does repudiation/non-repudiation work in such cases ?
Argument: It is ...
1
vote
3answers
394 views
How can alleged illegal downloading be detected?
Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method?
Update
Using a honey pot or monitoring the peers list makes ...
10
votes
2answers
278 views
Profiling hackers with keystroke dynamics
I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers.
I want to combine the keystroke timings that I capture in ttylog with other data ...
0
votes
2answers
184 views
Easy way to analyse my netstats for intrusions?
I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway.
When I issue a netstat -a, I see various ...
3
votes
2answers
10k views
Can a SIM card be tracked without cell phone and battery?
I have a SIM card alone without cell phone and battery. Can it be be tracked?
2
votes
2answers
145 views
Is this enough for an NIDS
I am doing my senior project on network intrusion detection system (ethernet networks) and I am having a bit of trouble deciding if I have added enough features.
Currently the system detects the ...
0
votes
2answers
176 views
How could an AV detect a virus that has a chance of not decrypting itself?
If I understand this correctly there is a chance the virus may not decrypt itself at all. How could an AV catch this?
In some cases, the decryptor may start with a header whose intent is
not ...
0
votes
1answer
116 views
Nessus doesn't find self-written plugins [closed]
I'm trying to write a nessus plugin. So I took an existing plugin (10056), and only added the line
display("hello world");
in the appropriate section and altered the script_id to a non-existing one.
...
3
votes
3answers
244 views
Are there DNS analysis tools that could detect bad DNS results?
Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results?
It would be very simply to detect an attack along the ...
2
votes
4answers
341 views
Detecting malware hidden in P2P traffic
Consider a network situation involving (only) Peer to Peer traffic in medium sized network.
For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
4
votes
1answer
588 views
How to detect cookie stuffing attacks?
So the question is how to detect cookie stuffing attacks and how to protect against them?
In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
2
votes
3answers
122 views
Find changes and modifications made to system by application or virus,
I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.
...
0
votes
3answers
2k views
How to trace malicious hackers?
What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker?
IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
-2
votes
3answers
328 views
Why bother with attack detection?
The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
2
votes
2answers
654 views
How to check if a website is sending out a virus?
I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website.
3 out of 6 people in the office have gotten ...
3
votes
1answer
444 views
How does OS detection work in practice?
I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.
But what kind of probes would distinguish a ...
5
votes
2answers
348 views
mysql security logging
Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time?
Im trying to detect brute force attempts.
...
4
votes
2answers
496 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
1
vote
3answers
494 views
How to find the OS of the target machine
I am new to this field. Currently I am using Linux OS and
my question is how can I find the OS of another machine to
which I do not have a direct access.
I am interested in any possibilities which ...
3
votes
4answers
213 views
Is there a security device to register unauthorised physical access?
I understand that it is not possible to secure your software if a third party has physical access to the box (eg colo). So may be I can install some sort of hardware (like a seal) which only need to ...
4
votes
1answer
214 views
What is it called when you give hackers a way in?
Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to?)
An is there a name for ...
18
votes
4answers
3k views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
13
votes
1answer
507 views
Are there Linux rootkits circulating that directly modify the kernel (without modules)?
It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
5
votes
1answer
275 views
How to detect infected machines on my wifi?
I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
10
votes
5answers
589 views
Detection and analysis of unknown malware
Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis?
Are ...
5
votes
3answers
164 views
Spamming exploits without user detection
So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
3
votes
1answer
242 views
IP reputation services – valuable tool for detecting compromises?
anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises?
services like:
https://www.iptrust.com/
http://ipremoval.sms.symantec.com/lookup/
