Tagged Questions
2
votes
1answer
138 views
Can linux (be made to) detect foreign connections to the ram bus?
I've been made aware on many answers and some comments that an attacker can read memory while a system is still running by attaching some sort of connection directly to the ram bus.
Can linux ...
-4
votes
0answers
58 views
Where can I look for malware that may have been installed on my machine?
I want to analysis my ubuntu box to detect if it was been hacked.
My question is:
what are all the place where to look to discover if some malicious software are started ?
The following is some kind ...
5
votes
2answers
159 views
Linux forensics questions (ssh config, user activity)
I'm a linux noob and have an assignment I'm a bit stumped on... We're given VirtualBox (vdi) images and raw files for the state of a linux server at 3 different dates.
We're supposed to answer:
...
5
votes
3answers
403 views
Appropriate defense for 404s in my logs - persistent web scans from one region
This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
8
votes
3answers
826 views
How to manually check for rootkits on a server
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server?
I'm looking for to to manually find the rootkit, not by automated software.
For example:
...
14
votes
1answer
736 views
Did someone really plug an iphone in, or are these symptoms of an exploit attempt?
My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in ...
