Detection is the act of discovering and/or determining the existence, presence, or fact of something.

learn more… | top users | synonyms

1
vote
1answer
294 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
1
vote
3answers
6k views

How to trace malicious hackers?

What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker? IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
2
votes
3answers
377 views

Repudiation in Copyright Infringement (BitTorrent)

Seeing this question : How can alleged illegal downloading be detected? sparked a question I have had for a long time. How does repudiation/non-repudiation work in such cases ? Argument: It is known ...
1
vote
1answer
44 views

How to configure Kismet to redetect same BSSIDs in a loop?

So I am working on a tool to detect any wifi device using Kismet. When I use Kismet, it works fine, but my problem is, it detects a device once, and until the MAC changes, it wont detect it again. ...
4
votes
3answers
773 views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
0
votes
1answer
56 views

To what extend can a DOS attack succeed even if it was detected?

While reading DOS detection and prevention http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf I've asked myself: Even if a firewall detects a DOS attack and begins ...
3
votes
1answer
701 views

How can I detect if someone is using an ssh tunnel as a proxy to connect to a VPN?

I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be ...
1
vote
1answer
71 views

attack signatures [closed]

I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I ...
0
votes
3answers
566 views

Elaborate Hacking attempt detected - now what?

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. ...
1
vote
3answers
207 views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I ...
2
votes
2answers
248 views

Analyzing Network Anomalies for Malicious events

For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies. Our main ...
-1
votes
2answers
163 views

ISP can detect DNS requests for a website. Can it do the same for websites embedded inside other websites ? [duplicate]

ISP can detect DNS requests for a web site, ie www.google.com . If I have a website ie www.mysite.com, and a webpage ie www.mysite.com/mypage.html and inside www.mysite.com/mypage.html , the web site ...
3
votes
4answers
237 views

To disconnect or not disconnect an intruder?

Most of the time, when an intruder is detected, we would disconnect it at once. However there are certain cases where the intruder is not disconnected. What are the benefits of not disconnecting the ...
1
vote
2answers
71 views

How to detect changes to client

I am developing a Java game and money is involved. As such, I want to prevent people from modifying the client if at all possible (I'm a game designer, not a security expert). I know that it is ...
3
votes
2answers
2k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
1
vote
4answers
442 views

Block all Nmap scan methods on Windows [closed]

How can I prevent someone from scanning my Windows box using Nmap? I used Comodo as my firewall but someone still can scan my box using Nmap and get some info like open services and OS detection.
2
votes
2answers
2k views

How effective is Windows Task Manager at identifying keyloggers?

I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick ...
6
votes
3answers
539 views

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
6
votes
2answers
304 views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
1
vote
1answer
112 views

Intrusions attempt monitoring (on MacOS X) [closed]

I know utilities such as last exist - but not sure if it's applicable for my needs - I'd like a system to notify me of any login attempts on any of my macs (home, work or remote). Attempts from a ...
5
votes
1answer
437 views

What techniques do web services use to identify password theft?

I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps. For example when I try to login to my ...
3
votes
1answer
319 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...
2
votes
2answers
794 views

SSL VPN Detection and possible to block

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic? In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
1
vote
1answer
349 views

Static analysis of Android applications using Androguard

I am building a project a part of which involves performing static analysis for Android applications. I know of Androguard and its tools that help in analyzing Android apks. But I am stuck and don't ...
2
votes
1answer
71 views

Server Detection Vectors

I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks). My ideas: change server header customize 404 ...
1
vote
2answers
238 views

Can malware come in any format?

After reading @Iszi's answer to this question he states Viruses attached in e-mails do not only come in .EXE files. They can be any form of document - PDF, PPT, DOC, XLS, SWF, etc. Are there ...
0
votes
2answers
282 views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
2
votes
4answers
549 views

Are malicious scripts in batch files detected by antiviruses?

we have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
18
votes
2answers
3k views

How does a crypter for bypassing antivirus detection work?

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
4
votes
1answer
109 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
3
votes
2answers
4k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
4
votes
3answers
492 views

Are there DNS analysis tools that could detect bad DNS results?

Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results? It would be very simply to detect an attack along the ...
2
votes
1answer
300 views

Bot detection ideas [php]

I am looking for bot detection ideas. I don't mind bots crawling my site, that's cool, the problem is when they start posting stuff. I recently had to erase 400 accounts because of a bad boy like ...
2
votes
1answer
184 views

Can linux (be made to) detect foreign connections to the ram bus?

I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus. Can linux ...
2
votes
2answers
189 views

Is interpreted malware easier to detect than compiled malware?

Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
8
votes
1answer
191 views

Is there a public database of mutex names that are associated with malware?

I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
2
votes
0answers
183 views

Snort Parallelization Techniques and its effect on DDOS detection capability

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
0
votes
1answer
90 views

Mechanisms to detect service abuse in the cloud

I want to ask if it is possible to detect the abuse of a service in the cloud. How can the SaaS provider be sure that the client does not use the service for criminal acts? For example how can Google ...
3
votes
2answers
181 views

Why some antiviruses detect viruses and some not?

I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
-2
votes
1answer
309 views

Foolproof Jailbreak detection? [closed]

I went through various posts which talks about jailbreak detection mechanisms. Whatever I came across is either something that apple would reject during the vetting process or something that could be ...
11
votes
5answers
750 views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
2
votes
4answers
599 views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
1
vote
3answers
738 views

How to find the OS of the target machine

I am new to this field. Currently I am using Linux OS and my question is how can I find the OS of another machine to which I do not have a direct access. I am interested in any possibilities which ...
0
votes
0answers
21 views

Steganalysis of outgoing traffic [duplicate]

Possible Duplicate: Detecting Steganography in images Is there any commercial traffic monitoring systems that implements steganalysis and could issue a warning upon suspicious file transfer ...
3
votes
2answers
24k views

Can a SIM card be tracked without cell phone and battery?

I have a SIM card alone without cell phone and battery. Can it be be tracked?
3
votes
4answers
246 views

Is there a security device to register unauthorised physical access?

I understand that it is not possible to secure your software if a third party has physical access to the box (eg colo). So may be I can install some sort of hardware (like a seal) which only need to ...
1
vote
3answers
684 views

How can alleged illegal downloading be detected?

Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method? Update Using a honey pot or monitoring the peers list makes ...
0
votes
2answers
222 views

How could an AV detect a virus that has a chance of not decrypting itself?

If I understand this correctly there is a chance the virus may not decrypt itself at all. How could an AV catch this? In some cases, the decryptor may start with a header whose intent is not ...
10
votes
2answers
328 views

Profiling hackers with keystroke dynamics

I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers. I want to combine the keystroke timings that I capture in ttylog with other data ...
0
votes
2answers
230 views

Easy way to analyse my netstats for intrusions?

I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway. When I issue a netstat -a, I see various ...