The art of responding to incidents in an organized and thoughtful manner.
4
votes
2answers
262 views
How can I find the malicious/backdoor codes without knowing the last modified date?
Last night my website got hacked and attacker edited the main index.php.
I was wondering even he edited that file, the last modified date did not change.
so I just worry if he would put the backdoor ...
2
votes
3answers
83 views
Responsible Disclosures and Getting Sued
Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? ...
1
vote
2answers
72 views
Is it advisable to fully record terminal interaction for incident response?
We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
4
votes
2answers
57 views
Incident Reporting or Notification Policy domain?
I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization.
...
0
votes
0answers
40 views
Where can I obtain publicly available data about security attacks in Asia and Pacific? [closed]
I am trying to run an analysis of trends of security attacks with respect to world events (i.e. oil price hike induces an increased amount of attacks on oil companies).
The scope of my project is ...
0
votes
1answer
372 views
Penetration testing job entry exam [closed]
What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is ...
1
vote
1answer
79 views
Compromised server with psyBNC - what are our next steps?
One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
0
votes
3answers
123 views
If my server was compromised, is my database safe?
I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
1
vote
4answers
513 views
My website has been hacked, what do i do next? [closed]
So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.
My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
17
votes
6answers
963 views
Best practices for handling computer viruses
I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware.
In a small-to-medium ...
3
votes
2answers
194 views
How to satisfy requirement 10.6 of PCI DSS?
The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
2answers
102 views
What goes into an average incident response process for a corporate network?
I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
2
votes
1answer
81 views
Quick Security Mitigations to Impending attacks
Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
6
votes
2answers
247 views
Will reporting phishing emails cause problems for the victim?
On GMail, I've received a phishing email from someone I know, and the email has been sent to other people the victim knows. One of the emails is claiming to be from their GMail address, while the ...
1
vote
1answer
106 views
How to know what's the type of an attack and from whom is sent?
I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked.
How do I know what kind of attack it is and from whom is sent?
When he attacks, the RDP freezes and the ...
5
votes
1answer
141 views
Cufon or Prototype as an attack vector for Blackhole exploit kit?
I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
It's being detected as a Blackhole exploit kit inside of a Cufon ...
0
votes
0answers
61 views
Handler's log solution for incident response [closed]
I am looking for a incident response handler's log solution that would scale well to record up to 1000 incidents/yr.
What do people use? Any good templates out there? Any software, preferably open ...
-1
votes
1answer
248 views
Extremely suspicious phone call — what to do? [closed]
Two days ago, I received a call. Someone with a female, possibly asian voice asked "are you using your computer in internet right now." I said "yes", then asked "who are you?". At this point, they ...
31
votes
5answers
771 views
How do I respond to a published security vulnerability in my application?
In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity.
On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
0
votes
0answers
69 views
How to decode this runforestrun gootkit [closed]
Infected site is hxxp://www.infraredpsi.com/Pluginlab/Scripts/menuscript.js
online scan result:
http://urlquery.net/report.php?id=141893
I can de-obfuscate the first layer of the code that use the ...
0
votes
0answers
79 views
What is the future of SOC? [closed]
Hi can anyone says working in security operation center (incident response) would be challenging and career growth. i am currently working in application security domain. comparing app security vs soc ...
3
votes
2answers
423 views
How do I run a security check on my WordPress server?
I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing.
But I don't know how ...
3
votes
2answers
146 views
Ftp constantly asked for a .exe file, what can i do?
I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
4
votes
3answers
261 views
What are the risks of posting my email address to pwnedlist.com?
pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database.
Are the people ...
4
votes
1answer
255 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
3
votes
4answers
884 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
-2
votes
3answers
328 views
Why bother with attack detection?
The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
3
votes
1answer
163 views
eBay account compromised/Credit Card used/Hosts files changed
To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
0
votes
1answer
92 views
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
0
votes
2answers
240 views
Unexplained downloading
I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark.
The ...
5
votes
2answers
3k views
How can I detect/withstand DNS amplification attack?
I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
1
vote
1answer
152 views
What are the most relevant security events/incidents any company should monitor?
What are the most relevant security events/incidents any company should monitor using event management tools? Related to servers, antivirus, networks, etc.
1
vote
1answer
169 views
Incident database? [duplicate]
Possible Duplicate:
Resources for data on security incidents
Do you know any websites where they put Information about Security Incidents that happened to organizations/people (e.g. ...
4
votes
3answers
280 views
Is it harmful to redirect web bugs to localhost on hosts file?
I was checking the article hosts file on Wikipedia, and I found this:
Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security ...
23
votes
7answers
599 views
Fostering an environment where honesty and disclosure are valued
UPDATE: The question is seeking real research based on behavior analysis of a significantly large sample people using well defined experiments. Posting answers based on opinions, or ad-hoc ...
0
votes
1answer
2k views
Wireless Adapters for Testing with BackTrack
I would like to begin testing and working with BackTrack. I have heard that the Alfa AWUS036H wireless adapter works well with BackTrack and allows for packet injection. This adapter, however, is ...
3
votes
2answers
132 views
Automatic harvesting of hacked hosts and reporting to domain/site admin
With so many internet attacks out there, I just think it would be convenient (and quicker and wise) if there is a way to automatically harvest the hacked hosts that are used to launch internet ...
9
votes
2answers
107 views
Encouraging security researchers to disclose vulnerabilities
What are approaches to forming solid relationships with security researchers?
For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
6
votes
3answers
603 views
How should a web page respond to a CSRF attack?
I know that you use tokens to prevent CSRF, but how should the receiving page respond when it is attacked? Should it fail silently, pretending the transaction was successful? Display an error message? ...
5
votes
3answers
208 views
Disclosing security vulnerabilities to paying customers first
Particular case
An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
0
votes
1answer
170 views
System image that does not allow for recovery of deleted files?
We are working with an contractor regarding a compromised computer. The contractor has asked for a dd dump of the drive. However, my understanding is that dd would allow the contractor to recover ...
5
votes
3answers
347 views
How to respond to attack made from my dedicated server?
There was a sudden unusual peak of outbound traffic from my hosted dedicated server (OS - Windows Server 2008 R2). The hoster threatened to block the server if the problem is not solved.
There are an ...
16
votes
5answers
464 views
What should I do when classified information stayed on a unauthorized laptop?
Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?
How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
7
votes
6answers
940 views
Facebook account keeps getting hacked, can't seem to figure out why or how?
One of my mate, she has a lot of friends on Facebook, uses it for marketing.
Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
8
votes
4answers
2k views
IIS logs show someone is trying to hack my site, what should I do?
It looks like someone is trying to hack my site. The following comes from my IIS log files:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: ...
17
votes
2answers
433 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
5
votes
1answer
87 views
Modeling vectors of an unknown exploit
Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
5
votes
2answers
206 views
Sony Attacks, what would you do?
If you where called by Sony right now, had 100% control over security, what would you do in the first 24-hours?
8
votes
3answers
808 views
How to manually check for rootkits on a server
Does anyone have a general step by step list on how to try discover rootkits on a Linux or Solaris server?
I'm looking for to to manually find the rootkit, not by automated software.
For example:
...
5
votes
2answers
206 views
Enterprise security incident response and detection
I have a decent understand and experience with securing and setting up smaller networks, although absolutely no enterprise experience. I understand at such a large scale there are different ...
