The detection tag has no wiki summary.
18
votes
4answers
4k views
How do you know your server has been compromised?
I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
14
votes
1answer
522 views
Are there Linux rootkits circulating that directly modify the kernel (without modules)?
It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
10
votes
5answers
597 views
Detection and analysis of unknown malware
Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis?
Are ...
10
votes
2answers
281 views
Profiling hackers with keystroke dynamics
I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers.
I want to combine the keystroke timings that I capture in ttylog with other data ...
8
votes
1answer
95 views
Is there a public database of mutex names that are associated with malware?
I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
5
votes
3answers
166 views
Spamming exploits without user detection
So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
5
votes
2answers
354 views
mysql security logging
Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time?
Im trying to detect brute force attempts.
...
5
votes
1answer
287 views
How to detect infected machines on my wifi?
I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
4
votes
1answer
215 views
What is it called when you give hackers a way in?
Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to?)
An is there a name for ...
4
votes
2answers
517 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
4
votes
1answer
460 views
How does OS detection work in practice?
I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.
But what kind of probes would distinguish a ...
4
votes
1answer
618 views
How to detect cookie stuffing attacks?
So the question is how to detect cookie stuffing attacks and how to protect against them?
In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
4
votes
3answers
297 views
Are there DNS analysis tools that could detect bad DNS results?
Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results?
It would be very simply to detect an attack along the ...
3
votes
2answers
12k views
Can a SIM card be tracked without cell phone and battery?
I have a SIM card alone without cell phone and battery. Can it be be tracked?
3
votes
4answers
214 views
Is there a security device to register unauthorised physical access?
I understand that it is not possible to secure your software if a third party has physical access to the box (eg colo). So may be I can install some sort of hardware (like a seal) which only need to ...
3
votes
2answers
151 views
Why some antiviruses detect viruses and some not?
I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
3
votes
1answer
249 views
IP reputation services – valuable tool for detecting compromises?
anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises?
services like:
https://www.iptrust.com/
http://ipremoval.sms.symantec.com/lookup/
3
votes
1answer
663 views
How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?
This is what I believe to be an interesting challenge :)
A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
2
votes
2answers
733 views
How to check if a website is sending out a virus?
I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website.
3 out of 6 people in the office have gotten ...
2
votes
2answers
147 views
Is this enough for an NIDS
I am doing my senior project on network intrusion detection system (ethernet networks) and I am having a bit of trouble deciding if I have added enough features.
Currently the system detects the ...
2
votes
4answers
353 views
Detecting malware hidden in P2P traffic
Consider a network situation involving (only) Peer to Peer traffic in medium sized network.
For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
2answers
116 views
Is interpreted malware easier to detect than compiled malware?
Is compiled code more of a security risk than interpreted code? I'm under the impression that it is due to the fact that compiled code can hide malicious code from malware scans.
2
votes
2answers
159 views
Analyzing Network Anomalies for Malicious events
For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main ...
2
votes
3answers
124 views
Find changes and modifications made to system by application or virus,
I would like to use either Hyper-V or Vmware to take a Clean Base snapshot and a snapshot after an application or virus has made changes so I can then see what was changed between the two images.
...
2
votes
3answers
222 views
Repudiation in Copyright Infringement (BitTorrent)
Seeing this question : How did an alleged illegal downloading be detected? sparked a question I have had for a long time.
How does repudiation/non-repudiation work in such cases ?
Argument: It is ...
2
votes
1answer
139 views
Can linux (be made to) detect foreign connections to the ram bus?
I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus.
Can linux ...
1
vote
3answers
506 views
How to find the OS of the target machine
I am new to this field. Currently I am using Linux OS and
my question is how can I find the OS of another machine to
which I do not have a direct access.
I am interested in any possibilities which ...
1
vote
4answers
304 views
Are malicious scripts in batch files detected by antiviruses?
we have many scripts in shared folders in our IT Department.
Are malicious scripts in batch files detected by antiviruses?
1
vote
3answers
2k views
How to trace malicious hackers?
What are some of the ways law enforcement agencies can trace a hacking attempt back to the hacker?
IP and MAC addresses can be spoofed easily, hackers can easily hide their tracks using compromised ...
1
vote
3answers
417 views
How can alleged illegal downloading be detected?
Joel Tenenbaum was accused of illegally downloading 30 songs. How might his action have been detected? Can anyone show a concrete method?
Update
Using a honey pot or monitoring the peers list makes ...
1
vote
1answer
67 views
Bot detection ideas [php]
I am looking for bot detection ideas. I don't mind bots crawling my site, that's cool, the problem is when they start posting stuff. I recently had to erase 400 accounts because of a bad boy like ...
1
vote
2answers
471 views
How effective is Windows Task Manager at identifying keyloggers?
I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick ...
0
votes
2answers
185 views
Easy way to analyse my netstats for intrusions?
I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway.
When I issue a netstat -a, I see various ...
0
votes
2answers
178 views
How could an AV detect a virus that has a chance of not decrypting itself?
If I understand this correctly there is a chance the virus may not decrypt itself at all. How could an AV catch this?
In some cases, the decryptor may start with a header whose intent is
not ...
0
votes
1answer
68 views
Mechanisms to detect service abuse in the cloud
I want to ask if it is possible to detect the abuse of a service in the cloud. How can the SaaS provider be sure that the client does not use the service for criminal acts? For example how can Google ...
0
votes
0answers
159 views
Snort Parallelization Techniques and its effect on DDOS detection capability
I want to ask a query about snort parallelization.
1) Can snort detection rate remains same for all attacks after parallelisation?
2) As the parallelisation of netowrk traffic in each core is based ...
0
votes
0answers
21 views
Steganalysis of outgoing traffic [duplicate]
Possible Duplicate:
Detecting Steganography in images
Is there any commercial traffic monitoring systems that implements steganalysis and could issue a warning upon suspicious file transfer ...
0
votes
1answer
122 views
Nessus doesn't find self-written plugins [closed]
I'm trying to write a nessus plugin. So I took an existing plugin (10056), and only added the line
display("hello world");
in the appropriate section and altered the script_id to a non-existing one.
...
-2
votes
3answers
335 views
Why bother with attack detection?
The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
-2
votes
1answer
252 views
Foolproof Jailbreak detection? [closed]
I went through various posts which talks about jailbreak detection mechanisms. Whatever I came across is either something that apple would reject during the vetting process or something that could be ...
