Detection is the act of discovering and/or determining the existence, presence, or fact of something.

learn more… | top users | synonyms

2
votes
2answers
214 views

Is it possible to defeat the OS detection capabilities of network scanning tools?

Network scanning tools such as nmap have the capability to infer operating system version based upon lower-level system details. EG: TCP/IP stack behavior, etc. Are there any known methods to trick ...
2
votes
4answers
1k views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
1answer
1k views

How can illegal downloads (not file sharing) be detected?

I understand that copyright holders can identify illegal filesharing over BitTorrent by simply taking part in the sharing process and noting IPs of peers. But how do they detect illegal downloads ...
2
votes
2answers
946 views

Can malware come in any format?

After reading @Iszi's answer to this question he states Viruses attached in e-mails do not only come in .EXE files. They can be any form of document - PDF, PPT, DOC, XLS, SWF, etc. Are there ...
2
votes
1answer
1k views

Bot detection ideas [php]

I am looking for bot detection ideas. I don't mind bots crawling my site, that's cool, the problem is when they start posting stuff. I recently had to erase 400 accounts because of a bad boy like ...
2
votes
2answers
339 views

Is interpreted malware easier to detect than compiled malware?

Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
2
votes
1answer
91 views

Why do phishing sites use images instead of just copying the HTML?

Why do phishing sites use pictures of the full site (e.g., they took screenshot and broke it up) instead of just copying the real HTML and modifying the target for form submission of ...
2
votes
1answer
90 views

Server Detection Vectors

I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks). My ideas: change server header customize 404 ...
2
votes
3answers
1k views

How can alleged illegal downloading be detected?

Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method? Update Using a honey pot or monitoring the peers list makes ...
2
votes
1answer
59 views

Effectiveness of Secure Boot on kernel-mode rootkit detection

With so many new patches and updates, how effect is Secure Boot on detecting kernel-mode rootkits?
2
votes
1answer
120 views

What does the http_uri content modifier do is SNORT

I am very confused about exactly what http_uri does. Can someone explain this to me w.r.t NORMALIZED and UNNORMALIZED uri fields?
2
votes
2answers
318 views

How can one find keyloggers in javascript?

Assuming no XSS and a client-side only page, how can a keylogger be identified in javascript code? Should I simply look for the id of the targeted fields and possibly some sort of DOM traversal to ...
2
votes
2answers
409 views

Analyzing Network Anomalies for Malicious events

For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies. Our main ...
2
votes
3answers
377 views

Find changes and modifications made to system by application or virus,

I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images. ...
2
votes
1answer
206 views

How to configure Kismet to redetect same BSSIDs in a loop?

So I am working on a tool to detect any wifi device using Kismet. When I use Kismet, it works fine, but my problem is, it detects a device once, and until the MAC changes, it wont detect it again. ...
2
votes
3answers
494 views

Repudiation in Copyright Infringement (BitTorrent)

Seeing this question : How can alleged illegal downloading be detected? sparked a question I have had for a long time. How does repudiation/non-repudiation work in such cases ? Argument: It is known ...
2
votes
0answers
47 views

Airgapped network security: feasable to prevent precompiled code from running to limit vulnerability to hacked firmware?

I'm not sure if this is the right medium to ask this but I'm looking for pointers or if this is being done. I realize that this is still a bit of a open question. When internal network holds critical ...
2
votes
1answer
215 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
2
votes
0answers
225 views

Snort Parallelization Techniques and its effect on DDOS detection capability [closed]

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
1
vote
3answers
1k views

How to find the OS of the target machine

I am new to this field. Currently I am using Linux OS and my question is how can I find the OS of another machine to which I do not have a direct access. I am interested in any possibilities which ...
1
vote
2answers
430 views

Signal listening

Is there a way to know if someone listens to signal I produce (air signal as well as signal on network)? Is there a way to know if the signal was listened along the way until the signal is reached to ...
1
vote
2answers
83 views

How to detect changes to client

I am developing a Java game and money is involved. As such, I want to prevent people from modifying the client if at all possible (I'm a game designer, not a security expert). I know that it is ...
1
vote
3answers
1k views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I ...
1
vote
2answers
438 views

Malicious self-executing code can only exist in EXIF data in JPEG images?

Let's say we got an infected JPEG image that just by viewing it can automatically execute the malicious code stored inside it. It can do this either by taking advantage of the image viewer's security ...
1
vote
3answers
12k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
1
vote
1answer
369 views

How can an online hack be traced back to the perpetrators?

What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question ...
1
vote
2answers
217 views

How can I detect unencrypted self-executing code in JPEG images?

Assuming that I have an infected image containing a self-executing malicious code that targets my image viewer and executes when I open the file. Supposing also that my computer is completely clean ...
1
vote
1answer
91 views

Detecting code source variants of the same function [closed]

Suppose I have this JavaScript malicious function f1() : <SCRIPT type="text/javascript"> function f1(){ a=1; b=2; c=a+b; } </SCRIPT> This function is embedded within a larger ...
1
vote
4answers
4k views

Block all Nmap scan methods on Windows [closed]

How can I prevent someone from scanning my Windows box using Nmap? I used Comodo as my firewall but someone still can scan my box using Nmap and get some info like open services and OS detection.
1
vote
1answer
2k views

How to simulate network attacks and use wireshark to detect them?

I am working on a project which involves me to simulate a network attack and to use wireshark to detect the attack. DOS/MIM etc. I have found the following links that provided help but there are still ...
1
vote
2answers
257 views

Detecting RDP on non-standard ports

How can RDP connections on the network be identified if they are no longer using TCP 3389 and instead using a non-standard port? If the administrator of a system changed the port for remote ...
1
vote
1answer
304 views

Detecting web app attacks by parsing log files [duplicate]

Following up on this question as the answers are now 5 years old: Can I detect web app attacks by viewing my Apache log file? My boss has tasked me with analyzing our access.log and error.log files ...
1
vote
1answer
144 views

SpyProxy: how does it work?

I have been reading about SpyProxy. Can someone explain me this phrase I found in the article ? Here it is: We monitor the guest OS and browser through “triggers” installed to look for sandbox ...
1
vote
1answer
452 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
1
vote
2answers
1k views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
1
vote
1answer
160 views

Can an attacker detect if I have a TARPIT enabled?

Last thing we want to do is provoke an attacker and offer them challenges or puzzles indirectly to give them a flag to stay and continue to hack rather than move on to other hosts. If possible, I do ...
1
vote
1answer
395 views

attack signatures [closed]

I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I ...
1
vote
1answer
1k views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
1
vote
0answers
86 views

What aspects of a Host OS can be detected from VirtualBox VM? [closed]

What aspects of a Host OS can be detected from VirtualBox VM? Processor and display features are all I can think of. What exactly about them? Any other features of the Host that a user with ...
1
vote
1answer
559 views

Intrusions attempt monitoring (on MacOS X) [closed]

I know utilities such as last exist - but not sure if it's applicable for my needs - I'd like a system to notify me of any login attempts on any of my macs (home, work or remote). Attempts from a ...
0
votes
2answers
321 views

Easy way to analyse my netstats for intrusions?

I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway. When I issue a netstat -a, I see various ...
0
votes
2answers
263 views

How could an AV detect a virus that has a chance of not decrypting itself?

If I understand this correctly there is a chance the virus may not decrypt itself at all. How could an AV catch this? In some cases, the decryptor may start with a header whose intent is not ...
0
votes
1answer
171 views

Is there a way of determining if tor is running on a remote machine?

In most of the companies, IT guys block some sites and by using TOR or other VPNs people walk around these blocks and gain access to blocked content. My question is, assuming TOR is running on ...
0
votes
3answers
1k views

Elaborate Hacking attempt detected - now what?

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. ...
0
votes
1answer
86 views

Integrity-Based Execution

Intrusion Detection Systems (IDS) rely on binary signatures or known-bad-behavior of malware in order to detect threats. It has become very clear that this approach has limited success due to the fact ...
0
votes
3answers
3k views

How to detect the so-called “undetectable” Gameover Zeus?

The media are currently (and have been) creating a huge ruckus surrounding the supposedly "undetectable" Gameover Zeus malware. The Daily Mail The Mirror The Independant PC World The Telegraph ...
0
votes
2answers
250 views

Solution for traffic capturing from router

i'm a newbie and i'm having a problem that i can't find it by google. I'm researching abbout DDoS detecting method now. As we can see that nowadays people often analyze networking traffic from router ...
0
votes
1answer
106 views

To what extend can a DOS attack succeed even if it was detected?

While reading DOS detection and prevention http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf I've asked myself: Even if a firewall detects a DOS attack and begins ...
0
votes
3answers
134 views

If I connect to a website using a cellular network, and change the sim card and connect again with the same phone, will they find its the same phone?

I read on a blog that when you connect to a website with your phone they track the model number id of the device, or something like it. I don't remember what its called. Even if you change your sim ...
0
votes
1answer
98 views

DDoS Detection devices available in the market? [closed]

Wanted to know what DDoS detection devices are currently available in the market.My organisation has its dedicated firewalls and routers.But we wanted to know if there are any devices in the market ...