Detection is the act of discovering and/or determining the existence, presence, or fact of something.

learn more… | top users | synonyms

69
votes
11answers
6k views

Sanitize computer after Homeland Security seizure [closed]

I flew from overseas back to the USA and all my electronic equipment was seized by Homeland Security, including my laptop computer, external hard drives, flash drives, etc. After more than a month I ...
33
votes
4answers
33k views

How do you know your server has been compromised?

I recently helped a client who had their server hacked. The hackers added some PHP code into the header of the homepage redirecting the user to a porn website — but only if they came from Google. This ...
29
votes
3answers
2k views

Is there a way to detect web server in case it's not present in HEADER?

I'm trying to detect what web server a particular website uses. For instance whether it's nginX, Apache, Tomcat and so on. I usually use Live HTTP Headers Firefox add-on. The problem is that sites ...
27
votes
4answers
2k views

Fake users in database for compromise detection

I have read of sites* adding fake users to their databases and then monitoring their usage. One of these fake users being used or even attempted login may mean database compromise etc. This sounds ...
22
votes
2answers
3k views

Can a Trojan hide itself, so its activity doesn't appear in task manager process? [duplicate]

Can malicious software hide itself, so its activity doesn't appear in the list of processes from Task Manager? Can it hide itself so when someone is controlling your computer, even if you open Task ...
21
votes
3answers
2k views

Would it be plausible to write your own anti-crypto-ransomware tool? [closed]

Question After reading about how basic ransomware targets and encrypts your files. I was wondering if it would be plausible to write your own script to try and detect such activities? Initial ...
21
votes
2answers
5k views

How does a crypter for bypassing antivirus detection work?

I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
13
votes
1answer
1k views

Are there Linux rootkits circulating that directly modify the kernel (without modules)?

It has been said, over and over, that disabling dynamic kernel module loading on Linux increases security. I understand why people give this advice, but I've always assumed that a bad guy could ...
12
votes
5answers
1k views

Detection and analysis of unknown malware

Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis? Are ...
11
votes
2answers
448 views

Profiling hackers with keystroke dynamics

I am writing a research paper on tracking hackers and how to include keystroke timings to create a profile of hackers. I want to combine the keystroke timings that I capture in ttylog with other data ...
9
votes
2answers
1k views

Are there / have there ever been viruses that completely evade virus scanners for very long?

Are there, or have there ever been viruses that completely evade all virus scanners for a long time (e.g. longer than a year?)
8
votes
3answers
8k views

Why is it so hard to trace origins of DDOS attacks?

According to the July 2009 cyber attacks Wikipedia article, US & South Korean governments suffered a DDOS attack on their websites. However, up till now they have not been able to find any ...
8
votes
1answer
424 views

Is there a public database of mutex names that are associated with malware?

I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
7
votes
2answers
13k views

How can I detect which background application is using the camera, microphone or GPRS?

I want to learn how to write and Android application that can detect a run time spy application. In this instance, a "spy application" is a background application that uses the camera, microphone and ...
7
votes
3answers
5k views

SSL VPN Detection and possible to block

Is it possible to determine the difference between a VPN on port 443 compared to standard SSL traffic? In order to access SSL websites you need port 443 open but if you setup a VPN Service on port ...
7
votes
2answers
116 views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
6
votes
3answers
17k views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? ...
6
votes
1answer
3k views

How does a website detect proxy? [duplicate]

How can a specific website detect that I'm surfing via proxy? Is there a way to use proxy and not get detected? If so, how?
6
votes
3answers
277 views

Spamming exploits without user detection

So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would ...
6
votes
3answers
1k views

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
6
votes
2answers
2k views

How effective is an IDS at catching targeted attacks

I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies. I was ...
6
votes
2answers
393 views

Can network admin detect port scan on a certain host?

Say, my laptop is connected to a large WiFi network with many other users. If a port scan is run on my IP by somebody else on the same WiFi network, is it possible for the network admin (or anybody) ...
6
votes
3answers
3k views

Possible to detect packed executable?

A packer is a way of obfuscating an executable program, i.e., transforming so the result is still executable and has the same effect when run, but looks different (so it won't be detected by static ...
5
votes
1answer
303 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
5
votes
1answer
357 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
5
votes
1answer
160 views

What is the proliferation of IMSI Catchers?

We know that IMSI-catcher detectors such as the Android-IMSI-Catcher-Detector project exist, but has anyone done a field study across various parts of the world as to how many there are and where? ...
5
votes
2answers
860 views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
5
votes
1answer
619 views

What techniques do web services use to identify password theft?

I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps. For example when I try to login to my ...
5
votes
2answers
1k views

How to detect infected machines on my wifi?

I currently live in a building with around 40-50 other tenants (mostly students) and we all share one connection to the Internet using one of 3 wifi routers that are spread throughout the building. ...
4
votes
2answers
256 views

Why some antiviruses detect viruses and some not?

I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
4
votes
4answers
4k views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
4
votes
1answer
176 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
4
votes
1answer
2k views

How to detect cookie stuffing attacks?

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
4
votes
1answer
62 views

Security monitoring in the cloud?

I am working for a company which works with PHI, HIPAA, PCI and other highest sensitivity data. Their current security architecture uses hardware network monitoring tools to monitor the network ...
4
votes
3answers
834 views

Are there DNS analysis tools that could detect bad DNS results?

Are there any tools (or at least methods that would work, if no free tools currently exist) which one could use to detect false DNS results? It would be very simply to detect an attack along the ...
4
votes
1answer
680 views

IP reputation services – valuable tool for detecting compromises?

anyone have anecdotes on how subscribing to an IP reputation service led them to discover internal compromises? services like: https://www.iptrust.com/ http://ipremoval.sms.symantec.com/lookup/
4
votes
2answers
17k views

How to detect/list rogue computers connected to a WIFI network without access to the Wifi Router interface?

This is what I believe to be an interesting challenge :) A relative (that lives a bit too far to go there in person) is complaining that their WIFI/Internet network performance has gone down ...
3
votes
2answers
70k views

Can a SIM card be tracked without cell phone and battery?

I have a SIM card alone without cell phone and battery. Can it be be tracked?
3
votes
4answers
389 views

Is there a security device to register unauthorised physical access?

I understand that it is not possible to secure your software if a third party has physical access to the box (eg colo). So may be I can install some sort of hardware (like a seal) which only need to ...
3
votes
2answers
225 views

Is this enough for an NIDS

I am doing my senior project on network intrusion detection system (Ethernet networks) and I am having a bit of trouble deciding if I have added enough features. Currently the system detects the ...
3
votes
4answers
2k views

Are malicious scripts in batch files detected by antiviruses?

We have many scripts in shared folders in our IT Department. Are malicious scripts in batch files detected by antiviruses?
3
votes
4answers
283 views

To disconnect or not disconnect an intruder?

Most of the time, when an intruder is detected, we would disconnect it at once. However there are certain cases where the intruder is not disconnected. What are the benefits of not disconnecting the ...
3
votes
3answers
4k views

How effective is Windows Task Manager at identifying keyloggers?

I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick ...
3
votes
1answer
2k views

How does OS detection work in practice?

I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them. But what kind of probes would distinguish a ...
3
votes
3answers
165 views

Detection and monitoring of important events on OpenVPN server

If an attacker can establish a VPN connection to the company network and have access to internal resources (by getting various certificates and credentials used to authenticate to the VPN server), ...
3
votes
1answer
212 views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
3
votes
1answer
64 views

Detect a Virtual Machine on my Wifi?

Is there a way to detect whether a machine connected to my wifi is a physical machine or a virtual machine?
3
votes
4answers
99 views

What kinds of attacks would be missed if we don't look at both host and network activity

Suppose I have both network based IDS and host based IDS installed in my environment, will I miss any security attacks if I don't correlate the information from these sources? If so, what are they? It ...
3
votes
1answer
3k views

How can I detect if someone is using an ssh tunnel as a proxy to connect to a VPN?

I've got an SSH server setup in a remote location, which I use to tunnel traffic from an android tablet. On the tablet, I have the Cisco AnyConnect app to connect to my company's VPN. We want to be ...
3
votes
1answer
771 views

Is it possible to detect host-machine of my virtual-machines?

So basically I need to know is there any way to find a connection (or relation) between packets sent by my VMs and my host machine. In my lab I have lots of workstations, each running a VirtualBox ...